MalwarePublished 18 Jun 2026

Gentlemen ransomware uses multiple EDR killers to disable defenses

Source Bleeping Computer

Description

The Gentlemen ransomware-as-a-service (RaaS) is actively developing and maintaining a suite of endpoint detection and response (EDR) killers to help affiliates evade detection in attacks. [...]

Impact

The use of multiple sophisticated EDR killers allows Gentlemen ransomware affiliates to disable a wide range of endpoint security products, increasing the likelihood of successful ransomware deployment and data theft. By gaining kernel-level privileges through vulnerable drivers, the attackers can evade detection and prevent security tools from interfering with their operations. The targeting of numerous security vendors' processes indicates a broad capability to bypass defenses. The inclusion of credential stealing further increases the threat to victim organizations. This capability enhances the ransomware group's operational effectiveness and complicates incident response.

Defensive guidance

Organizations should monitor vendor advisories for updates on vulnerable drivers and potential patches. Given the use of stolen or invalid digital signatures and packed binaries, enhanced detection techniques focusing on behavior and anomaly detection may be necessary. FortiGate endpoint configurations should be reviewed as they appear to influence targeting.

Summary

Gentlemen ransomware uses a collection of EDR-killing tools, notably GentleKiller with at least eight variants, to disable endpoint defenses early in attacks. These tools impersonate legitimate security products and use the 'bring your own vulnerable driver' technique to escalate privileges to kernel level and disable security engines. GentleKiller targets over 400 processes related to approximately 48 security vendors. The ransomware group also integrates external EDR killers like HexKiller, ThrottleBlood, and HavocKiller, and uses a Rust-based credential stealer named OxideHarvest. The framework is designed for easy adaptation to new vulnerable drivers. The group selects targets based on FortiGate endpoint configurations and has been linked to attacks on corporate victims including a Romanian energy provider.

References

bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2026, 22:35 UTC

References

Community reviews