The Gentlemen equips affiliates with a centralized EDR-killer suite, rapidly weaponizing BYOVD exploits to disable security tools before ransomware attacks.

ESET says Gentlemen RaaS gives affiliates a GentleKiller EDR-killer suite targeting 400 processes across 48 security tools.

ESET says Gentlemen RaaS gives affiliates a GentleKiller EDR-killer suite targeting 400 processes across 48 security tools.

A highly sophisticated EDR-killing framework, dubbed GentleKiller, was used by the Gentlemen ransomware-as-a-service (RaaS) gang to systematically disable endpoint security tools before deploying its ransomware payload. The findings by ESET, published on June 17, 2026, detail how Gentlemen, one of the most active ransomware gangs in Q1 2026, provides affiliates with a centralized, operator-maintained suite of EDR killers, a model rare even among top-tier ransomware operations. GentleKiller is an in-house EDR-killing framework with at least eight distinct variants, each impersonating a different legitimate security product and abusing a unique vulnerable or malicious kernel-level driver. The technique used is Bring Your Own Vulnerable Driver (BYOVD) , loading a legitimately signed but exploitable driver to terminate security processes at the kernel level, bypassing user-mode protections. In total, GentleKiller targets more than 400 processes mapped to 48 security products, including industry leaders such as Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Palo Alto Networks, ESET, Bitdefender, Kaspersky, and McAfee/Trellix. The framework operates on a loop, periodically scanning and terminating targeted processes every two seconds, as evidenced by the output shown below. Window spawned by GentleKiller [ESET Research] The eight GentleKiller variants abuse drivers from Kaspersky ( eb.sys ), FACEIT Anti-Cheat ( nseckrnl.sys ), Valorant ( GameDriverX64.sys ), Javelin/Safetica ( stpm_old.sys / stpm_new.sys ), Zemana WatchDog ( dmx.sys ), Qihoo 360 ( 360netmon_wfp.sys ), IObit ( IMFForceDelete ), and the PoisonX rootkit. A defining capability of Gentlemen is its ability to operationalize newly published BYOVD proof-of-concept (PoC) exploits within days of public release. Tools such as UnknownKiller and PoisonKiller were incorporated into GentleKiller’s arsenal within days of their public GitHub disclosure, demonstrating a well-resourced and agile development pipeline, according to ESET research . This rapid adoption distinguishes Gentlemen from most other RaaS operators, who typically wait weeks or months before adapting publicly released exploits into production-ready tooling. Third-Party EDR Killers Integrated Into the Suite Beyond GentleKiller, Gentlemen also integrates three externally sourced EDR killers into its affiliate-facing suite: HexKiller — Previously attributed exclusively to the Warlock gang; abuses a Baidu Antivirus BdApi driver ( googleApiUtil64.sys ) ThrottleBlood — Previously observed in MedusaLocker and DragonForce intrusions; abuses a TechPowerUp LLC driver ( ThrottleBlood.sys ) HavocKiller — First publicly disclosed by Huntress on March 19, 2026, but observed in real-world intrusions as early as January 23, 2026; abuses a Huawei Audio driver ( havoc.sys ) All three tools are standardized through a shared defense-evasion layer that applies Enigma or Themida binary protectors, impersonates security vendors with fabricated version information, copied digital signatures, and matching icons. Gentlemen applies its evasion strategy at the compiled binary level, allowing it to protect even EDR killers for which it does not own the source code. This creates significant attribution challenges, as tools from different ransomware groups appear near-identical once processed through Gentlemen’s standardization pipeline. The gang also uses OxideHarvest, a Rust-written credential stealer maintained by a Gentlemen affiliate, which harvests credentials from Chromium-based and Gecko-based browsers across compromised hosts. Gentlemen emerged in late 2025 as a RaaS operation founded by hastalamuerte , a former Qilin affiliate , and rapidly became one of the five most active ransomware gangs in Q1 2026. Unlike most major ransomware groups that focus heavily on US-based targets, Gentlemen deliberately targets victims in Southeast Asia, South America, and Western Europe, selecting targets primarily based on FortiGate misconfigurations rather than geographic criteria. The gang was further exposed by an internal data leak in May 2026, which confirmed that its operators actively develop, maintain, and distribute GentleKiller and the broader EDR-killer suite to vetted affiliates. Gentlemen offers affiliates an unusually generous 90% revenue share, lowering the barrier to entry and accelerating its affiliate recruitment. Security teams should prioritize driver allowlisting and enforce Microsoft’s Vulnerable Driver Blocklist to prevent BYOVD-style attacks. Defenders should also monitor for the GentlemenCollection staging directory and anomalous kernel driver loading events. Correlating process-termination patterns, especially targeting security software with driver installation events, remains the most reliable behavioral detection signal against GentleKiller and its variants. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post GentleKiller Ransomware Abuses Vulnerable Drivers to Disable 400+ EDR Security Processes appeared first on Cyber Security News .

A highly sophisticated EDR-killing framework, dubbed GentleKiller, was used by the Gentlemen ransomware-as-a-service (RaaS) gang to systematically disable endpoint security tools before deploying its ...

bring your own vulnerable driver (BYOVD) read more about The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware group is distributing a standardized suite of EDR-killing tools to affiliates, centered on GentleKiller and supported by leaked or third-party utilities such as HexKiller, ThrottleBlood, and HavocKiller. ESET also found that the group rapidly weaponizes new BYOVD PoCs and that a Rust-based credential stealer, OxideHarvest, has been used...

Daily Recap, Police and international partners disrupted a malware network tied to Russia’s Evil Corp, while Operation Endgame took down SocGholish servers and cleaned 14,971 compromised WordPress sites. Security teams also warned that The Gentlemen ransomware uses the GentleKiller EDR-killer framework to target 400 security processes before encryption. #EvilCorp #OperationEndgame #SocGholish #WordPress #TheGentlemen #GentleKiller #Texas #FortiBleed #Fortinet #Klue #Icarus #GravitySMTP #usbliter8 #SecureROM #AppleA12 #AppleA13 #AutoJack #Beats #Continuum

The Gentlemen ransomware-as-a-service operation is actively maintaining a set of EDR killers, led by the GentleKiller tool, to help affiliates evade security defenses during attacks. ESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet. #Gentlemen #GentleKiller #HexKiller #ThrottleBlood #HavocKiller #FortiGate #Oltenia #SystemBC

TikTok video by The Intel Desk

A new ransomware group,

ESET researchers found that the Gentlemen ransomware group centrally maintains and distributes a standardized suite of EDR killers to affiliates, led by its in-house framework GentleKiller and supplemented with tools like HexKiller, ThrottleBlood, and HavocKiller. The gang targets victims worldwide rather than focusing on the United States, and its leaked internal data in May 2026 confirmed its rapid BYOVD adoption, operational tooling practices, and link to the credential stealer OxideHarvest. #Gentlemen #GentleKiller #HexKiller #ThrottleBlood #HavocKiller #OxideHarvest