Back Feeds2.Feedburner

GentleKiller targets more than 400 security processes across 48 products

Feeds2.Feedburner •Anamarija Pogorelec • June 18, 2026

Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors. An internal data leak from the group in May 2026 confirmed the arrangement and exposed the gang’s leader discussing the supply of … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen Ransomware Uses Advanced EDR Killers to Evade Detection The Gentlemen ransomware-as-a-service (RaaS) gang has developed a sophisticated suite of endpoint detection and response (EDR) killers, including a tool called GentleKiller, which has at least eight variants. These tools are designed to disable security defenses during attacks, targeting over 400 processes associated with 48 security products. The group has been particularly active in 2026, focusing on victims in Southeast Asia, South America, and Western Europe. An internal data leak in May 2026 provided insights into their operations, confirming the use of both proprietary and third-party EDR killers. Gentlemen employs the 'bring your own vulnerable driver' (BYOVD) technique to elevate privileges and disable security engines. The gang has also been linked to previous attacks, including a compromise of the Romanian energy provider Oltenia. Security teams report that only 14% of successful attacks trigger alerts, indicating a significant evasion capability. The threat landscape remains critical as Gentlemen continues to refine its tools and tactics. 23 sources 68

Extracted Entities

GentleKiller targets more than 400 security processes across 48 products

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (2)

Ransomware Groups (1)