The Gentlemen ransomware-as-a-service operation is building its affiliate program around a practical and dangerous idea: make it easier to shut down security tools before the encryptor ever runs.
At the center of that approach is GentleKiller, an endpoint detection and response killer framework designed to impair defenses on compromised Windows systems. The broader toolkit also includes third-party or leaked tools such as HexKiller, ThrottleBlood, and HavocKiller, giving affiliates a ready-made defense-evasion layer rather than forcing each affiliate to assemble its own tooling.
The development points to a ransomware group that is trying to make intrusions more repeatable. Instead of treating EDR killing as a one-off step handled differently by each affiliate, Gentlemen appears to be standardizing that part of the attack chain with shared techniques, fake product identities, copied-looking icons and certificates, and vulnerable drivers used in bring your own vulnerable driver attacks.
How GentleKiller Fits Into the Attack Chain
EDR-killer tools are typically used after attackers gain enough access to a machine but before they deploy ransomware. Their job is straightforward: terminate or disable security processes that could block payload execution, detect suspicious behavior, or give defenders time to contain the intrusion.
GentleKiller is built around that role. The framework has been described as using multiple variants that mimic legitimate products and abuse different vulnerable or malicious drivers as part of BYOVD activity. Some reporting around the exact number of variants and targeted processes has not been independently verified, but the described design is consistent with a toolkit meant to give affiliates several options for disabling endpoint protection.
The framework reportedly targets security software processes across a large set of products, with the commonly cited figure being 400 processes tied to 48 security programs. Because that figure has not been independently verified here, the safer takeaway is that GentleKiller is not aimed at a single vendor or product family. It is built for broad endpoint-defense disruption.
The Drivers Tied to GentleKiller Variants
The GentleKiller variants are associated with drivers commonly discussed in BYOVD attacks. In a BYOVD scenario, attackers bring a vulnerable signed driver onto a compromised system and use it to perform actions that would normally be blocked by the operating system or security tools.
| Variant or impersonated component | Driver name | Role in the toolkit |
|---|---|---|
| FACEIT Anti-Cheat | nseckrnl.sys | Driver abused for defense evasion |
| Valorant | GameDriverX64.sys | Driver abused for defense evasion |
| Javelin | stpm_old.sys or stpm_new.sys | Driver abused for defense evasion |
| Network Blocker | 360netmon_wfp.sys | Driver abused for defense evasion |
| Cleaner | IMFForceDelete.sys | Driver abused for defense evasion |
The toolset also overlaps with other BYOVD-based EDR killers used in ransomware activity:
- HexKiller, associated with googleApiUtil64.sys and previously linked to Warlock ransomware activity.
- ThrottleBlood, associated with ThrottleBlood.sys and observed in activity tied to MedusaLocker and DragonForce affiliates.
- HavocKiller, also known as HwAudKiller, associated with havoc.sys.
PoisonX.sys has also appeared in recent BYOVD activity used to terminate endpoint protection, including campaigns where attackers disabled security tooling before ransomware deployment. Another intrusion involved attackers using BeyondTrust Remote Support before ransomware was deployed, with PoisonX.sys and hrwfpdrv.sys used against defensive tooling.
Why Standardized EDR Killers Matter
Ransomware affiliate programs usually work by splitting responsibilities. Operators maintain the brand, infrastructure, leak site, and payloads, while affiliates break into networks and run attacks. EDR killing has often sat on the affiliate side of that divide.
Gentlemen’s approach appears more centralized. By handing affiliates a standardized suite of EDR-killer tools, the operation lowers the technical bar for affiliates and makes the pre-encryption phase more consistent. That can make the group more attractive to operators who want a faster path from initial access to impact.
The tooling also appears designed for fast adaptation. When new proof-of-concept BYOVD techniques become public, a shared framework makes it easier to integrate newly abused drivers into existing workflows. That does not mean every claimed capability should be treated as confirmed, but it does show why defenders should treat vulnerable driver abuse as an operational risk rather than a niche technique.
What Defenders Should Watch For
The immediate defensive lesson is not limited to GentleKiller. Security teams should assume ransomware operators will continue testing ways to disable endpoint tools before deploying payloads, especially through signed but vulnerable drivers.
Useful monitoring and hardening steps include:
- Watch for unexpected driver loads, especially drivers with names associated with anti-cheat, cleaner, network filtering, or vendor utility software.
- Block known vulnerable drivers where supported by endpoint protection, application control, or Windows Defender Application Control policies.
- Monitor for sudden termination of security processes across multiple vendors or tools on the same host.
- Review remote support tooling exposure, permissions, and logging, especially where remote access products can reach high-value systems.
- Keep endpoint agents protected with tamper protection and alerting for failed or forced service termination attempts.
- Correlate driver-loading events with privilege escalation, credential access, and ransomware staging behavior.
The group’s broader tooling reportedly includes OxideHarvest, a Rust-based credential stealer also known as buildx641. It is described as targeting data from major browsers including Chrome, Edge, Brave, Opera, Firefox, Vivaldi, Waterfox, and several privacy-focused or lesser-used browsers. That makes browser credential and cookie theft another area defenders should fold into ransomware response planning.
Secure Boot Bypass Risk Adds Pressure
The disclosure arrives alongside a separate warning about vendor-signed UEFI applications vulnerable to Secure Boot bypass through BYOVD-style abuse. The affected applications are tied to vendors including Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.
In that scenario, an attacker with administrative privileges or physical access could execute code during the early boot phase before the operating system initializes, if the target system trusts the affected vendor certificate. The recommended mitigation is to apply updates to the UEFI Forbidden Signature Database, known as DBX, so affected signed binaries are no longer trusted during boot.
For security teams, the practical message is the same across both cases: signed code is not automatically safe code. Ransomware operators are looking for trusted components they can bend into attack tools, and vulnerable driver governance needs to be treated as part of ransomware defense rather than a low-level platform hygiene task.