Gentlemen ransomware loads vulnerable drivers to kill security tools

Acronis says The Gentlemen installs vulnerable Lenovo and Safetica drivers to kill security processes before encryption, claiming over 800 victims.

Acronis Threat Research Unit says The Gentlemen, a Go-based ransomware-as-a-service also known as ArmCorp and Phantom Mantis, used custom droppers to install legitimate but vulnerable kernel drivers and terminate security processes before encryption. The drivers are Lenovo BootRepair.sys 2.5.30.11281 and Safetica ProcessMonitorDriver 11.26.18; Safetica’s insufficiently protected IOCTL is CVE-2025-70795. The malware also disables Microsoft Defender real-time protection, stops security, database, virtual-machine, email and backup services, and deletes Volume Shadow Copies. Encryption uses ChaCha20; an analyzed Windows build appends .cyvzca. The group claims more than 800 victims, especially in the United States and Europe, and names Windows, Linux, NAS and BSD as targets. Those victim totals are unverified criminal claims.