The Gentlemen RaaS Ships an In-House EDR Killer to Affiliates
GentleKiller bundles signed-driver abuse, third-party utilities, and a kill list of roughly 400 security processes — handed out as part of the affiliate package.
The Gentlemen ransomware crew isn't just renting out an encryptor. The group is actively maintaining a custom EDR-killing framework, dubbed GentleKiller, and shipping it to affiliates as part of the standard intrusion kit.
That matters because most RaaS programs outsource defense evasion to whatever BYOVD tool the affiliate happens to favor. The Gentlemen are centralizing it.
GentleKiller is less a single binary than a portfolio. It blends in-house tooling with repurposed third-party utilities, and it carries a hardcoded process kill list reported at roughly 400 entries — covering the usual cast of EDR agents, AV services, telemetry forwarders, and backup helpers.
The operational pattern is familiar to anyone who has read a BYOVD writeup in the last two years. Drop a vulnerable signed driver. Load it. Use kernel-mode primitives to terminate protected processes that user-mode callers can't touch. Then stage the encryptor.
What's different here is the productization. Affiliates get a maintained tool with updates, rather than scraping together their own driver-abuse chain from public PoCs.
A few operational notes for defenders:
- Microsoft's Vulnerable Driver Blocklist is the cheapest control here, and it's off by default on a surprising number of fleets. Confirm it is enabled and updated. The list lives at the Microsoft Recommended Driver Block Rules page.
- Alert on driver loads from user-writable paths. Most BYOVD chains stage the driver in
%TEMP%,%PROGRAMDATA%, or a fresh subdirectory under the user profile. A signed driver loading from those locations is rarely benign. - Treat sudden silence from an EDR agent as an incident, not a glitch. Tamper-protection telemetry and out-of-band agent heartbeats catch this earlier than any on-host signature.
- Look for batch process termination patterns hitting your security stack in sequence. A kill list of 400 processes does not execute quietly.
The Gentlemen surfaced earlier this year and have been working through the typical mid-tier RaaS playbook: double extortion, a leak site, affiliate recruitment on Russian-language forums. Investing engineering time into a maintained EDR killer suggests the operators expect to be around for a while (or at least long enough to amortize the development cost before the inevitable rebrand).
No CVE is being burned here in the traditional sense. BYOVD abuses drivers that are signed and, by Microsoft's definition, still trusted unless explicitly blocked. That is the entire point of the technique, and it is why the blocklist — not the patch cycle — is the relevant control.
If your EDR vendor has not published guidance on detecting GentleKiller-style termination chains against their own agent, ask them. The answer tells you something either way.
