ESET Details GentleKiller EDR-Killer Framework Used by Gentlemen Ransomware Gang (infosecurity-magazine.com)

• GentleKiller targets over 400 processes across 48 security products.
• Uses BYOVD technique with at least eight variants.
• Gentlemen gang supplies EDR-killers to affiliates, unusual in the ransomware ecosystem.
• Defenders should monitor for driver abuse and process termination.

"ESET researchers have analyzed GentleKiller, a framework used by the Gentlemen ransomware-as-a-service operation to disable endpoint detection and response (EDR) software before encryption. The framework uses the bring-your-own-vulnerable-driver (BYOVD) technique, targeting over 400 processes across 48 security products. Gentlemen, which emerged in late 2025, provides this tool to its affiliates, unlike most ransomware operations. Defenses focus on blocking known-vulnerable drivers and monitoring for sudden shutdowns of security processes."