GentleKiller Ransomware Bypasses Security by Targeting Vulnerable Drivers and Disabling Over 400 EDR Processes

Essential Insights

1. The Gentlemen ransomware gang used a sophisticated framework called GentleKiller, capable of disabling over 400 security processes by impersonating legitimate security drivers at the kernel level through BYOVD techniques.
2. GentleKiller contains at least eight variants, each targeting specific security products, and swiftly integrates newly published exploits—demonstrating rapid, agile development.
3. The operation also incorporates three externally sourced EDR killers—HexKiller, ThrottleBlood, and HavocKiller—standardized to evade detection, complicating attribution efforts.
4. To defend against this threat, security measures should include driver allowlisting, monitoring for suspicious driver loads and process terminations, and enforcing Microsoft’s Driver Blocklist.

Problem Explained

In June 2026, ESET revealed that the notorious ransomware gang, Gentlemen, employed a sophisticated framework called GentleKiller to disable endpoint security tools before launching their attacks. This framework, unique among top-tier cybercriminal groups, includes at least eight variants that impersonate legitimate security software by abusing vulnerable drivers, specifically through a method known as Bring Your Own Vulnerable Driver (BYOVD). This technique involves loading signed, yet exploitable, drivers to terminate security processes at the kernel level, effectively bypassing protective barriers. Consequently, GentleKiller systematically targeted over 400 processes linked to major security vendors like Microsoft Defender, CrowdStrike, and Kaspersky, repeatedly scanning and killing these processes every two seconds. The group’s rapid integration of newly released BYOVD exploits, alongside third-party tools, showcases their agile and resourceful development pipeline. This offensive capability, combined with an internal leak revealing their operations and a 90% revenue-sharing model for affiliates, underscores their prominence and threat in the cybersecurity landscape. Security professionals are advised to implement strict driver allowlisting and monitor for signs of anomalous kernel driver activity to mitigate such threats effectively.

The report, authored by cybersecurity researcher ESET, highlights how Gentlemen’s strategic targeting of vulnerabilities in endpoint protection, coupled with their deployment of a standardized evasion technique, has significantly expanded their operational capacity. By standardizing their evasion toolkit and rapidly adapting to new exploits, they create substantial attribution challenges for defenders. The gang’s deliberate focus on regions like Southeast Asia, South America, and Western Europe, rather than the United States, indicates targeted geopolitical interests. Moreover, security agencies and organizations are encouraged to monitor specific indicators—such as the exploitation of known drivers and process-termination behaviors—to strengthen defenses against this advanced threat actor.

Risk Summary

The “GentleKiller Ransomware” attack exploits weak drivers to disable over 400 endpoint detection and response (EDR) security processes. This breach can happen to any business, regardless of size or industry. If successful, it leaves systems vulnerable and unprotected, allowing malware to spread quickly. As a result, crucial data may be stolen, operations disrupted, and financial losses incurred. Moreover, it undermines trust with customers and partners, damaging reputation. Consequently, without robust protections, your business faces severe risks—highlighting the urgent need for strong security measures.

Possible Actions

Ensuring swift response to the threat posed by GentleKiller ransomware, which exploits vulnerable drivers to disable over 400 EDR security processes, is crucial for safeguarding organizational assets and maintaining operational integrity. Rapid remediation helps prevent the spread of malware, minimizes data loss, and reinforces overall cybersecurity resilience.

Detection & Analysis

• Monitor for unusual driver activity and system behavior.
• Use advanced threat detection tools to identify exploitation signs.
• Conduct thorough digital forensics to understand attack vectors.

Containment

• Isolate affected systems immediately to prevent lateral movement.
• Disable network connections for compromised devices.
• Remove or quarantine malicious drivers and files.

Eradication

• Use trusted security solutions to eliminate malicious drivers.
• Apply specialized cleanup tools targeting ransomware components.
• Remove any persistence mechanisms installed by the attacker.

Recovery

• Restore impacted systems from clean, verified backups.
• Verify integrity of driver and system files before restoring operation.
• Incrementally reconnect systems to network, monitoring for re-infection.

Prevention & Hardening

• Keep all drivers and operating systems updated with latest patches.
• Implement strict access controls for driver installation and modification.
• Enforce least privilege policies for user and system accounts.
• Disable or restrict the use of vulnerable or unsigned drivers.
• Regularly review and enhance endpoint detection and response capabilities.
• Conduct user training to recognize suspicious activity and phishing attempts.

Ongoing Monitoring

• Continuously monitor systems for signs of exploitation or anomalies.
• Set up alerts for abnormal driver or process activities.
• Regularly audit security configurations and logs to detect potential vulnerabilities.

Continue Your Cyber Journey

Discover cutting-edge developments in Emerging Tech and industry Insights.

Access world-class cyber research and guidance from IEEE.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1