The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
Read with caution - this story is only being covered by one news source that has a ‘low factuality’ rating, which means the outlet has a history of poor reporting practices. Learn more about factuality ratings here.6 Articles
6 Articles
Ransomware as a Service (RaaS) operations are constantly evolving, and among them is the Gentlemen group, which uses advanced techniques to disable security systems. The Gentlemen RaaS operation uses the GentleKiller framework to attack over 400 security processes. The Gentlemen RaaS ransomware operation develops and maintains a suite of Endpoint Detection and Response (EDR) tools that it offers to partners to disable system defenses before depl…
Gentlemen RaaS Unifies HexKiller, ThrottleBlood, and HavocKiller in New Evasion Suite
An analysis of the Gentlemen ransomware-as-a-service (RaaS) operation has revealed a sophisticated, centralized approach to neutralizing endpoint detection and response (EDR) solutions. This unified defense evasion framework sets the group apart in an increasingly crowded ransomware landscape, significantly lowering the technical barrier for affiliates and driving the gang into the top five most active operations […] The post Gentlemen RaaS Unif…
Killing me gently: Inside Gentlemen’s EDR killer framework | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware - National Cyber Security Consulting
ESET researchers analyzed the robust EDR-killing toolset of the ransomware-as-a-service gang Gentlemen. Since the beginning of 2026, Gentlemen has emerged as one of the most active gangs in the ransomware ecosystem. The group distinguishes itself through a mature, operator-maintained set of endpoint detection and response (EDR) killers, i.e., tools for disrupting security software. Additionally, unlike […] Thank you for subscribing to our RSS fe…
Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform
The principle behind BYOVD is simple enough: once an attacker has gained admin privileges through an account takeover, they load a legitimate, but old and vulnerable vendor driver, inside which lies an exploitable vulnerability. This extends the power of admin control to kernel level, allowing them to target the EDR drivers in a direct way. EDR tools’ vulnerability to a newer generation of evasion techniques has been known for some time; a 2024 …
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is centered around a framework that's known as GentleKiller. "They also incorporate third-party or
Coverage Details
Bias Distribution
- 100% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
