CampaignPublished 30 Jun 2026

Not very gentlemanly: Analyzing a zero-day exploit used to disable targets' EDRs

Source AlienVault OTX General

Description

The Gentlemen ransomware group, which emerged in July 2025, employed a zero-day vulnerability in a bring-your-own-vulnerable-driver (BYOVD) attack to disable endpoint detection and response systems. During an incident investigated in early April, the group leveraged an obscure third-party driver named ktapi.sys from Kontron to bypass security protections. The sophisticated exploit chains multiple advanced techniques to navigate Windows exploit mitigations, including bypassing Supervisor Mode Access Prevention and Supervisor Mode Execution Prevention. The toolkit enables the attackers to call privileged kernel mode functions from user mode processes, ultimately terminating EDR processes including Windows Defender, ESET, Palo Alto Cortex XDR, and SentinelOne. The vulnerability had no prior public documentation and was previously absent from vulnerable driver blocklists.

Impact

Successful exploitation allows attackers to disable multiple major EDR solutions, including Windows Defender, ESET, Palo Alto Cortex XDR, and SentinelOne, by terminating their processes at the kernel level. This significantly reduces endpoint security effectiveness, facilitating further malicious activity such as ransomware deployment. The vulnerability's zero-day status and absence from blocklists increase the risk of undetected compromise in affected environments.

Defensive guidance

Organizations should monitor vendor advisories for updates regarding the Kontron ktapi.sys driver and consider restricting or blocking the use of this driver where possible. Since the vulnerability is not yet publicly documented or patched, heightened vigilance and layered security controls are recommended. Avoid relying solely on EDR solutions that can be terminated by kernel-level exploits.

Summary

This campaign involves a zero-day exploit used by the Gentlemen ransomware group to disable EDR protections via a BYOVD attack leveraging the Kontron ktapi.sys driver. The exploit chain bypasses Windows kernel mitigations including Supervisor Mode Access Prevention and Supervisor Mode Execution Prevention, enabling user mode processes to invoke privileged kernel mode functions. This capability is used to terminate critical EDR processes, effectively neutralizing endpoint security defenses. The vulnerability was unknown prior to this incident and is not listed in existing vulnerable driver blocklists, indicating a novel attack vector.

Not very gentlemanly: Analyzing a zero-day exploit used to disable targets' EDRs

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Hashes 3

Community reviews

Description

AI analysisMachine-generated, updated 1 Jul 2026, 07:36 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Hashes 3

Community reviews

Related threats