[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftxAWiYSOlrk-V5VWufyh923F_D5b4AmeziuQOpeX-zw":3},{"article":4,"iocs":54,"watch_terms":66,"solutions":67,"lesson":180},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"439b0243-3706-4783-a47b-ca38b74ca607","Gentlemen ransomware uses multiple EDR killers to disable defenses","gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses-42866a","The Gentlemen ransomware-as-a-service (RaaS) is actively developing and maintaining a suite of endpoint detection and response (EDR) killers to help affiliates evade detection in attacks. [...]","The Gentlemen ransomware-as-a-service (RaaS) is actively developing and deploying a suite of EDR killers, including a tool called GentleKiller with at least eight variants. These tools leverage the BYOVD technique to gain kernel-level privileges and disable security products from over 48 vendors. The group also incorporates external tools like HexKiller, ThrottleBlood, and HavocKiller for redundancy or specific scenarios.","Gentlemen ransomware uses multiple EDR killers to disable defenses.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F18\u002Fgentlemen.jpg","2026-06-18T22:31:52+00:00","2026-06-19T00:00:10.121009+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Gentlemen","threat_actor",{"name":21,"type":22},"GentleKiller","product",{"name":24,"type":22},"HexKiller",{"name":26,"type":22},"ThrottleBlood",{"name":28,"type":22},"HavocKiller",{"name":30,"type":22},"OxideHarvest","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":33,"name":34,"slug":35},null,"Ransomware","ransomware",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57,59,60,61,63],{"type":43,"value":21,"context":56},"EDR killer tool used by Gentlemen ransomware",{"type":43,"value":24,"context":58},"External EDR killer tool incorporated by Gentlemen ransomware",{"type":43,"value":26,"context":58},{"type":43,"value":28,"context":58},{"type":43,"value":30,"context":62},"Rust-based credential-stealer tool used by Gentlemen ransomware",{"type":43,"value":64,"context":65},"SystemBC","Proxy malware botnet linked to Gentlemen ransomware victims",[21,24,26],{"controls":68,"vendors":154},[69,97,125],{"slug":70,"name":71,"problem":72,"products":73},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":70,"product_name":94,"url":95,"description":96},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,109,117],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":98,"product_name":106,"url":107,"description":108},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":126,"name":127,"problem":128,"products":129},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[155,158,163,166,171,173,175],{"slug":139,"name":140,"logo_path":141,"roles":156},[157],"affected",{"slug":159,"name":160,"logo_path":161,"roles":162},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[157],{"slug":147,"name":148,"logo_path":149,"roles":164},[165],"reported_by",{"slug":167,"name":168,"logo_path":169,"roles":170},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[157],{"slug":75,"name":76,"logo_path":77,"roles":172},[157],{"slug":131,"name":132,"logo_path":133,"roles":174},[157],{"slug":176,"name":177,"logo_path":178,"roles":179},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[157],{"slug":181,"title":182,"body":183,"framework_refs":184,"framework_notes":197},"gentlemen-ransomware-deploys-edr-killers-to-blind-defenses-before-attack","Gentlemen Ransomware Deploys EDR Killers to Blind Defenses Before Attack","The Gentlemen ransomware group exploits the Bring Your Own Vulnerable Driver (BYOVD) technique to load legitimate but vulnerable kernel drivers, escalating to kernel-level privileges and systematically disabling endpoint detection and response (EDR) tools across 48+ vendors. This approach renders the organization's primary last-line defense blind before ransomware payload deployment even begins. The use of multiple redundant EDR-killing tools (GentleKiller, HexKiller, ThrottleBlood, HavocKiller) demonstrates deliberate resilience against partial defenses, meaning no single security product can be relied upon alone. This matters because organizations that depend solely on EDR solutions have a critical single point of failure that sophisticated ransomware groups are actively engineering around.",[185,186,187,188,189,190,191,192,193,194,195,196],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-9: Protection of Audit Information","NIST CSF DE.CM-4: Malicious Code Detection","NIST CSF PR.PT-3: Least Functionality Principle","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1068: Exploitation for Privilege Escalation (BYOVD)","Microsoft Vulnerable Driver Blocklist (HVCI \u002F WDAC)","ITIL Change Management: Controlled Driver\u002FSoftware Deployment",{}]