Gentlemen ransomware uses multiple EDR killers to disable defenses
Gentlemen ransomware uses multiple EDR killers to disable defenses.
The Gentlemen ransomware-as-a-service (RaaS) is actively developing and deploying a suite of EDR killers, including a tool called GentleKiller with at least eight variants. These tools leverage the BYOVD technique to gain kernel-level privileges and disable security products from over 48 vendors. The group also incorporates external tools like HexKiller, ThrottleBlood, and HavocKiller for redundancy or specific scenarios.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GentleKiller?
Get an email when a new story names GentleKiller, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Gentlemen ransomware group exploits the Bring Your Own Vulnerable Driver (BYOVD) technique to load legitimate but vulnerable kernel drivers, escalating to kernel-level privileges and systematically disabling endpoint detection and response (EDR) tools across 48+ vendors. This approach renders the organization's primary last-line defense blind before ransomware payload deployment even begins. The use of multiple redundant EDR-killing tools (GentleKiller, HexKiller, ThrottleBlood, HavocKiller) demonstrates deliberate resilience against partial defenses, meaning no single security product can be relied upon alone. This matters because organizations that depend solely on EDR solutions have a critical single point of failure that sophisticated ransomware groups are actively engineering around.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GentleKiller
- malware — HexKiller
- malware — ThrottleBlood
- malware — HavocKiller
- malware — OxideHarvest
- malware — SystemBC