The Gentlemen RaaS Ships an In-House EDR Killer to Affiliates
GentleKiller bundles signed-driver abuse with third-party utilities and a kill list of roughly 400 security processes, handed out as part of the affiliate package.
Key points
- The Gentlemen RaaS operates GentleKiller, a maintained EDR-killing framework distributed to affiliates before encryptor deployment.
- GentleKiller combines in-house tooling with repurposed third-party utilities and a hardcoded kill list of roughly 400 security processes.
- The framework abuses signed but vulnerable drivers to terminate protected processes from kernel mode, a technique known as BYOVD (bring your own vulnerable driver).
- Microsoft's Vulnerable Driver Blocklist is the primary control, but it is off by default on many systems.
- Sudden EDR silence should be treated as an incident, not a configuration glitch.
The Gentlemen aren't just renting out an encryptor. They're maintaining a custom defense-evasion framework and shipping it to affiliates as standard kit.
That distinction matters. Most RaaS programs let affiliates source their own BYOVD tooling from public proof-of-concept repositories. The Gentlemen are centralizing it, which means affiliates get versioned updates rather than a scrounged-together driver-abuse chain.
GentleKiller is less a single binary than a portfolio. It blends in-house code with repurposed third-party utilities and carries a hardcoded process kill list of roughly 400 entries, covering EDR agents, AV services, telemetry forwarders and backup processes.
The operational pattern itself is well-documented. Drop a signed but vulnerable driver, load it, use kernel-mode primitives to terminate protected processes that user-mode callers can't touch, then stage the encryptor. Our coverage of BYOVD research goes back to 28 May 2026, including work on coaxing drivers into range without their physical hardware present. What's new here is the productization: a maintained tool with a roadmap, not a one-shot script.
For defenders, a few controls follow directly from how the framework operates.
Microsoft's Vulnerable Driver Blocklist is the cheapest mitigation available, and it's disabled by default on a surprising number of fleets. Confirm it is enabled and current. The list lives at the Microsoft Recommended Driver Block Rules page.
Alert on signed drivers loading from user-writable paths. BYOVD chains typically stage the driver in %TEMP%, %PROGRAMDATA%, or a fresh user-profile subdirectory. A signed driver appearing in those locations is rarely benign.
Tamper-protection telemetry and out-of-band agent heartbeats catch EDR silence earlier than any on-host signature. Treat that silence as an incident. A kill list of 400 processes executing in sequence also leaves a visible pattern in process-termination logs if you're collecting them.
The Gentlemen are not a new subject here. Our earlier story on 11 June 2026, "The Gentlemen: A RaaS Affiliate That Grew Up and Wrote Its Own Worm", traced how the crew moved from renting LockBit, Qilin and Medusa lockers to building its own propagating payload. A maintained EDR killer is the logical next investment for a group that has already written its own encryptor and worm.
No CVE is being burned here. BYOVD abuses drivers that are signed and, by Microsoft's definition, still trusted unless explicitly blocked. The blocklist, not the patch cycle, is the relevant control.
If your EDR vendor hasn't published guidance on detecting GentleKiller-style termination chains against their own agent, ask them. The answer tells you something either way.
Should you worry?
Yes, if your fleet doesn't have the driver blocklist enforced. The Gentlemen's move to a maintained, distributed EDR killer lowers the skill floor for affiliates considerably. The technique isn't novel, but the packaging is, and that's what scales a threat.
