ArmCorp

Mentions · 7d1
Mentions · 30d1
All mentions1
First seenOct 21, 2026
Last mentioned4d ago

Timeline

1 articles · newest first

Gentlemen ransomware kills security tools with Lenovo and Safetica drivers

Acronis droppers load BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18, then terminate matching processes from kernel mode.

GBHackersupdated Oct 21, 15:30 UTC · 4d agofirst Oct 21, 12:21 UTC · 4d agoRansomwareExploited2 sourcesCVE-2025-70795

Related CVEs

by mentions

CVE-2025-70795<1%5.5
STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that…
published Apr 17, 2026

Appears with

Safeticavendor · 1
Phantom Mantisthreat actor · 1
ProcessMonitorDriverproduct · 1
Acronisorganization · 1
Lenovovendor · 1
Gentlementhreat actor · 1
BootRepair.sysproduct · 1
Gentlemenmalware · 1

Entities are extracted by the model from each article. First seen Oct 21, 2026, last mentioned 4d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.