Gentlemen ransomware kills security tools with Lenovo and Safetica drivers
Acronis droppers load BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18, then terminate matching processes from kernel mode.
74
Threat actor
Gentlemen
- Mentions · 7d0
- Mentions · 30d4
- All mentions5
- First seenAug 24, 2026
- Last mentioned9d ago
Timeline
5 articles · newest firstAttackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
34
Ransomware Hacker Uses AI Coding Assistant as Attack Channel Against Enterprise Networks
Ransomware affiliate Azazel used an AI coding assistant's MCP tools to attack more than two dozen organizations.
82
Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
Gentlemen ransomware affiliate Azazel used Model Context Protocol as live command-and-control across victims in six countries.
78
GentleKiller targets more than 400 security processes across 48 products
ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.
68
Related CVEs
by mentions- CVE-2025-70795<1%5.5STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that…
Appears with
- GitLabproduct · 2
- Azazelthreat actor · 2
- CloudSEKorganization · 2
- GitLabvendor · 2
- Gentlemenmalware · 2
- DragonForcethreat actor · 1
- OpenAI Assistants APIproduct · 1
- Microsoft Graph APIproduct · 1
- MedusaLockerthreat actor · 1
- GentleKillermalware · 1
- Mandiantorganization · 1
- Googlevendor · 1
- Group-IBorganization · 1
- Safeticavendor · 1
- Havoc Frameworkmalware · 1
- Phantom Mantisthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.