Gentlemen Ransomware Deploys EDR Killers to Blind Defenses Before Attack
Written by AI from the linked story. Not reviewed by an editor. How this works
The Gentlemen ransomware group exploits the Bring Your Own Vulnerable Driver (BYOVD) technique to load legitimate but vulnerable kernel drivers, escalating to kernel-level privileges and systematically disabling endpoint detection and response (EDR) tools across 48+ vendors. This approach renders the organization's primary last-line defense blind before ransomware payload deployment even begins. The use of multiple redundant EDR-killing tools (GentleKiller, HexKiller, ThrottleBlood, HavocKiller) demonstrates deliberate resilience against partial defenses, meaning no single security product can be relied upon alone. This matters because organizations that depend solely on EDR solutions have a critical single point of failure that sophisticated ransomware groups are actively engineering around.
Tactical Insight
Immediate actions
- Enroll in Microsoft's Vulnerable Driver Blocklist and enforce it via Windows Defender Application Control (WDAC) to prevent known BYOVD driver abuse.
- Audit currently loaded kernel drivers across all endpoints and remove or block any drivers not explicitly required for business operations.
- Enable tamper protection on all EDR/AV solutions to prevent unauthorized process termination or service disruption.
Long-term improvements
- Implement a defense-in-depth strategy layering EDR, network detection (NDR), SIEM, and deception technologies so that disabling one layer does not blind the entire security stack.
- Maintain a strict application and driver allowlist using tools like WDAC or AppLocker to prevent unauthorized kernel-level code execution.
- Establish a formal vulnerable driver management program that tracks CVEs associated with signed drivers and pushes blocklist updates on a defined cadence.
Detection measures
- Deploy out-of-band monitoring (e.g., network flow analysis, cloud-delivered telemetry) that operates independently of host-based agents so kernel-level tampering does not eliminate all visibility.
- Alert on any attempt to load, install, or execute drivers not present in your approved driver inventory, treating such events as high-severity incidents.
- Integrate threat intelligence feeds covering RaaS tooling (e.g., GentleKiller variants) into your SIEM to detect known malicious driver hashes before execution.