GentleKiller targets more than 400 security processes across 48 products
ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.
ESET analyzed the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework, confirmed through an internal data leak from May 2026. The framework has at least eight variants impersonating legitimate security products and abusing vulnerable or malicious kernel drivers, targeting more than 400 process names across 48 security products. Gentlemen emerged in late 2025, became one of the five most active ransomware gangs in Q1 2026, offers affiliates a 90% ransom share, and practices double extortion using Go-based and C-based ESXi encryptors. The suite also reuses outside tools including HexKiller, ThrottleBlood, and HavocKiller, unified by a shared evasion layer that mimics well-known security vendors.
- Eight GentleKiller variants each impersonate a different product and abuse a different vulnerable kernel driver.
- Victim selection rests centrally on the target's FortiGate firewall configuration.
- Gang folded recently disclosed BYOVD PoCs (UnknownKiller, PoisonKiller) into tooling within days.
- Victims concentrated in Southeast Asia, South America, and Western Europe rather than the U.S.
- ATT&CK
- T1562.001 Impair Defenses: Disable Security ToolsT1486 Data Encrypted for ImpactT1068 Exploitation for Privilege EscalationT1036.005 Masquerading: Match Legitimate Name or Location
- Malware
- GentleKiller
From the original article
3 min read at helpnetsecurity.com
Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.