In the crowded and ruthless landscape of ransomware-as-a-service, operational differentiation is rare. Most criminal operators hand affiliates a payload and leave the messy work of disabling endpoint defenses to chance and individual skill. A group known as The Gentlemen has taken a fundamentally different approach — one that is attracting skilled affiliates, accelerating attack velocity, and forcing defenders to rethink assumptions about how modern ransomware intrusions unfold.
A Centralized Killing Machine
Since surfacing in late 2025, The Gentlemen have claimed over 500 victims and positioned themselves among the most active ransomware operations globally. Their rise is not attributable to a novel encryption engine or unusually sophisticated initial access techniques. The competitive edge lies earlier in the attack chain — specifically, in a centrally managed, standardized toolkit designed to systematically destroy endpoint detection and response (EDR) tooling before a single byte of ransomware code executes.
At the heart of this capability is a framework researchers have designated GentleKiller. It represents an operator-maintained suite distributed directly to affiliates, removing one of the most technically demanding barriers to entry in the ransomware ecosystem: reliably neutralizing modern security software at scale.
By centralizing EDR-killing functions, the group has effectively lowered the technical floor for affiliate recruitment while simultaneously raising the ceiling on operational effectiveness — a powerful combination in an increasingly competitive criminal marketplace.
Inside GentleKiller: Architecture and Technique
GentleKiller currently encompasses at least eight distinct variants, each engineered around a technique known as Bring Your Own Vulnerable Driver, or BYOVD. The attack methodology exploits the implicit trust Windows extends to signed kernel-mode drivers. By loading a legitimate but vulnerable — or in some cases outright malicious — driver into a target environment, the attacker gains the kernel-level privileges necessary to terminate protected security processes from below the operating system's visibility threshold.
Each GentleKiller variant impersonates a different legitimate software product and abuses a different driver. Drivers linked to well-known security and software vendors — including components associated with anti-cheat systems, endpoint protection platforms, and utility software — have all been weaponized within the framework. Despite surface-level variation, forensic analysis reveals a shared development template underlying all eight variants. Structural and behavioral similarities strongly indicate a common codebase modified with minimal effort per deployment, a design that prioritizes rapid iteration over uniqueness.
The aggregate targeting capability is substantial. Across all variants, the framework scans for and terminates processes associated with more than 400 executables spanning 48 distinct security products, including leading enterprise platforms from major vendors across the EDR, XDR, and traditional antivirus categories.
Speed as a Weapon: Days from PoC to Production
Perhaps the most operationally significant characteristic of GentleKiller is the speed with which the operators integrate newly disclosed vulnerability research. When proof-of-concept EDR-killer code becomes public, the group has demonstrated the ability to weaponize and deploy it within a matter of days. Two documented cases — designated UnknownKiller and PoisonKiller by researchers — both transitioned from public PoC disclosure to active use in real intrusions within days of their release.
This tempo makes traditional patch-and-mitigate cycles largely irrelevant as a defensive response. By the time an organization has evaluated a newly disclosed kernel driver vulnerability, The Gentlemen may already be deploying it operationally.
Third-Party Tools and a Standardized Evasion Layer
GentleKiller is not the suite's only component. Three externally sourced EDR-killing tools have been identified within the same operational infrastructure, each previously associated with other ransomware affiliates or groups. What distinguishes their deployment here is the standardization layer applied uniformly across all tools — both homegrown and acquired:
The presence of tools previously exclusive to other ransomware gangs within The Gentlemen's centralized directory suggests active acquisition and curation by the operators — functioning less like a criminal gang and more like a platform provider maintaining a tooling catalog for its affiliate network.
Victimology and Target Selection
The group's victim geography diverges sharply from patterns established by other major ransomware operations. While contemporaries exhibit heavy concentration in North American targets, The Gentlemen's victim distribution skews toward Southeast Asia, South America, and Western Europe. Internal data indicates this distribution reflects a deliberate, centralized target selection process rather than geographic preference. Victims appear to be identified primarily through FortiGate misconfigurations, with the operators distributing selected targets to affiliates rather than allowing decentralized prospecting.
This structured approach to victim acquisition represents another dimension of operational maturity — one that concentrates initial access expertise at the operator level while enabling affiliates to focus on execution.
What You Should Do
- Audit kernel driver exposure immediately. Implement application control policies that restrict which drivers can load. Microsoft's recommended driver blocklist should be treated as a baseline, not a ceiling.
- Harden EDR with tamper protection. Ensure EDR platforms are configured with maximum tamper resistance enabled. Kernel-level protection features should be active in all production environments.
- Prioritize FortiGate configuration reviews. Given the group's documented reliance on FortiGate misconfigurations for initial access, organizations running FortiGate infrastructure should conduct immediate configuration audits and validate firmware currency.
- Monitor for BYOVD indicators proactively. Threat hunting queries targeting unexpected kernel driver loads, particularly drivers associated with gaming anti-cheat, legacy security utilities, or obscure third-party software, should be standard practice.
- Treat PoC disclosure as a deployment countdown. The window between public vulnerability research and criminal operationalization is now measured in days. Security teams must accelerate their own evaluation and mitigation cycles accordingly.
- Layer defenses beyond the endpoint. Given the explicit goal of neutralizing endpoint security before payload delivery, network-level detection, deception technologies, and identity-based controls are critical compensating layers.
The Gentlemen represent something more structurally concerning than a capable ransomware gang. They represent the maturation of ransomware-as-a-service into a disciplined platform model — one where operational complexity is abstracted away from affiliates, enabling a broader pool of attackers to execute sophisticated intrusions. Defending against that model requires defenders to operate with equivalent discipline.
