This campaign involves a zero-day exploit used by the Gentlemen ransomware group to disable EDR protections via a BYOVD attack leveraging the Kontron ktapi.sys driver. The exploit chain bypasses Windows kernel mitigations including Supervisor Mode Access Prevention and Supervisor Mode Execution Prevention, enabling user mode processes to invoke privileged kernel mode functions. This capability is used to terminate critical EDR processes, effectively neutralizing endpoint security defenses. The vulnerability was unknown prior to this incident and is not listed in existing vulnerable driver blocklists, indicating a novel attack vector. No CVE or patch information is available, and the exploit is not currently known to be widespread in the wild.

Successful exploitation allows attackers to disable multiple major EDR solutions, including Windows Defender, ESET, Palo Alto Cortex XDR, and SentinelOne, by terminating their processes at the kernel level. This significantly reduces endpoint security effectiveness, facilitating further malicious activity such as ransomware deployment. The vulnerability's zero-day status and absence from blocklists increase the risk of undetected compromise in affected environments.

No official patch or remediation is currently available for this zero-day vulnerability. Organizations should monitor vendor advisories for updates regarding the Kontron ktapi.sys driver and consider restricting or blocking the use of this driver where possible. Since the vulnerability is not yet publicly documented or patched, heightened vigilance and layered security controls are recommended. Avoid relying solely on EDR solutions that can be terminated by kernel-level exploits. Patch status is not yet confirmed — check vendor advisories for current remediation guidance.