Gentlemen ransomware kills security tools with Lenovo and Safetica drivers
Original title: Gentlemen Ransomware Hackers Hijack Legitimate Lenovo Drivers to Disable Security Software
Acronis droppers load BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18, then terminate matching processes from kernel mode.
Acronis Threat Research Unit says the Gentlemen ransomware operation used custom droppers in a recent incident to install legitimate but vulnerable Lenovo and Safetica kernel drivers and terminate security processes before encryption. Safetica's insufficiently protected IOCTL is tracked as CVE-2025-70795; Lenovo's BootRepair.sys exposes an unauthenticated IOCTL that can end arbitrary processes. The Russian-speaking RaaS group, also known as ArmCorp and Phantom Mantis, claims more than 800 victims, especially in the United States and Europe. Those totals are criminal claims, not verified compromises.
Unconfirmed: The claim of more than 800 victims, and the sector list, are the group's own figures rather than confirmed compromises.
- Dropped driver names were PhantomKiller_clone_04_94354C0F.sys and STProcessMonitorNew_clone_03_FC21F904.sys.
- The driver calls ZwOpenProcess and ZwTerminateProcess after an IOCTL with the target PID.
- Encryption uses ChaCha20; the analyzed build appends .cyvzca and drops README-GENTLEMEN.txt.
- Persistence uses UpdateSystem and UpdateUser tasks plus GupdateS and GupdateU Run keys.
- The group emerged under its own brand in mid-2025 after reported LockBit and Qilin affiliate work.
Impact: Kernel termination of security tools before ransomware encryption
| Product | Affected |
|---|---|
| Safetica ProcessMonitorDriver | 11.26.18 |
| Lenovo BootRepair.sys | 2.5.30.11281 |
- 1.Hunt for the named Safetica and Lenovo driver clones loaded as services.
- 2.Match the four published SHA-256 hashes for the Windows samples and EDR killers.
- 3.Watch for Defender exclusions, cleared logs, and Volume Shadow Copy deletion alongside those drivers.
- CVEs
- CVE-2025-70795
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1562.001 Disable or Modify ToolsT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1053.005 Scheduled Task
- Threat actors
- GentlemenArmCorpPhantom Mantis
- Malware
- Gentlemen
- Organizations
- Acronis
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-70795 | STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that… | 5.5 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f | one. Indicators of compromise Category SHA-256 Hash Windows 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f Windows 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efae |
| sha256 | 143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676 | 530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 EDR killer 143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676 EDR killer a1500204822fb16556a274132d802ba18a7e8b95cf134bd1 |
| sha256 | 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 | dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f Windows 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 EDR killer 143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e |
| sha256 | a1500204822fb16556a274132d802ba18a7e8b95cf134bd17b473f915e8cda81 | b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676 EDR killer a1500204822fb16556a274132d802ba18a7e8b95cf134bd17b473f915e8cda81 Note: IP addresses and domains are intentionally defanged ( |
From the original article
3 min read at gbhackers.com
The Gentlemen ransomware operation is abusing legitimate Lenovo and Safetica kernel drivers to terminate security software, weakening endpoint defenses before encryption.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.