The Gentlemen RaaS Uses Gentle Killer EDR Framework Targeting 400 Security Processes
Summary: The Gentlemen ransomware-as-a-service operation maintains a suite of EDR killers for affiliates, built around a framework called GentleKiller that comes in eight variants, each impersonating a different legitimate product and abusing a different vulnerable or malicious driver in a bring-your-own-vulnerable-driver attack. GentleKiller targets 400 processes tied to 48 security programs, and ESET reports the group operationalizes newly disclosed BYOVD proof-of-concept exploits within days of public release.
Bottom line: The group has claimed 504 victims since emerging in March 2025, and ESET says centralizing a ready-to-use EDR-killer suite lowers the entry barrier for affiliates - meaning more actors can disable your endpoint defenses before the encryptor runs.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026