Back Feeds.4Sysops

Gentlemen ransomware uses GentleKiller to disable security software

Feeds.4Sysops •IT News • June 19, 2026

The Gentlemen ransomware-as-a-service group is deploying a specialized suite of tools designed to disable endpoint detection and response (EDR) software. The primary utility, dubbed GentleKiller, exists in at least eight variants that impersonate legitimate security products like Kaspersky and WatchDog. These tools aim to neutralize defenses early in an attack to ensure that data exfiltration and encryption proceed without interference. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen Ransomware Uses Advanced EDR Killers to Evade Detection The Gentlemen ransomware-as-a-service (RaaS) gang has developed a sophisticated suite of endpoint detection and response (EDR) killers, including a tool called GentleKiller, which has at least eight variants. These tools are designed to disable security defenses during attacks, targeting over 400 processes associated with 48 security products. The group has been particularly active in 2026, focusing on victims in Southeast Asia, South America, and Western Europe. An internal data leak in May 2026 provided insights into their operations, confirming the use of both proprietary and third-party EDR killers. Gentlemen employs the 'bring your own vulnerable driver' (BYOVD) technique to elevate privileges and disable security engines. The gang has also been linked to previous attacks, including a compromise of the Romanian energy provider Oltenia. Security teams report that only 14% of successful attacks trigger alerts, indicating a significant evasion capability. The threat landscape remains critical as Gentlemen continues to refine its tools and tactics. 23 sources 68

Extracted Entities

Gentlemen ransomware uses GentleKiller to disable security software

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (4)

Ransomware Groups (1)