Gentlemen Ransomware's GentleKiller Disables 48 EDR Products

The Gentlemen ransomware crew is treating the job of switching off endpoint defences as a proper product line. Researchers at ESET have been tracking a bespoke tool they're calling GentleKiller, which already exists in at least eight variants and likes to dress up as legitimate software from Kaspersky, Valorant, Javelin and WatchDog.

The underlying trick is the well-worn Bring Your Own Vulnerable Driver approach: load a signed-but-flawed kernel driver, gain the privileges that come with it, and use that perch to shut down whatever security tooling is in the way. What makes GentleKiller worth paying attention to is the modularity. Each variant slots in a different vulnerable driver, but the obfuscation, the process-killing logic and the target list barely change. When a fresh driver flaw surfaces, the crew can bolt it on without rewriting much of anything.

A serious kill list

The scope is broad. GentleKiller goes after more than 400 processes tied to roughly 48 security products, hitting most of the names you'd expect: Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, Bitdefender, McAfee and Kaspersky among them.

The binaries are wrapped in commercial packers (Enigma and Themida) and signed with stolen certificates that have since been revoked. Alongside the in-house tool, Gentlemen affiliates have access to at least three external EDR killers and a Rust-based credential stealer called OxideHarvest, which looks more likely to have been bought in than written by the gang itself.

Picking victims by their firewall

One of the more interesting details is how Gentlemen choose who to hit. ESET reckons target selection leans, at least in part, on victims' FortiGate configurations. That sits awkwardly next to the recent FortiBleed leak, which exposed nearly 74,000 FortiGate VPN credentials. The same group has already hit Romanian energy provider Oltenia and is linked to a SystemBC botnet running on more than 1,570 compromised corporate hosts.

The bit that should bother defenders

The quiet assumption behind a lot of security architectures is that the EDR will catch whatever slips past everything else. GentleKiller and its peers exist specifically to break that assumption. Once an attacker is operating inside the network with administrative rights and a vulnerable driver to hand, the agent sitting on the endpoint is no longer a neutral referee. It's just another process, and one the attacker is actively working to silence.

Which is a long way of saying the fight is increasingly won earlier in the chain. Phishing-resistant authentication, tight privilege boundaries, rapid response to suspicious logins and a workforce that recognises social engineering when it lands in the inbox all do more work than people give them credit for. By the time GentleKiller is loading a dodgy driver on a domain controller, most of the meaningful decisions have already been made.