Gentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
74
Product
ProcessMonitorDriver
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 21, 2026
- Last mentioned4d ago
Timeline
2 articles · newest firstGentlemen ransomware kills security tools with Lenovo and Safetica drivers
Acronis droppers load BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18, then terminate matching processes from kernel mode.
74
Related CVEs
by mentions- CVE-2025-70795<1%5.5STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that…
Appears with
- Lenovovendor · 2
- Safeticavendor · 2
- Acronisorganization · 2
- BootRepair.sysproduct · 2
- Gentlementhreat actor · 1
- Gentlemenmalware · 1
- The Gentlementhreat actor · 1
- Gentlemen ransomwaremalware · 1
- Microsoftvendor · 1
- Microsoft Defenderproduct · 1
- Windowsproduct · 1
- Phantom Mantisthreat actor · 1
- ArmCorpthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.