The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and deploying a suite of tools designed to disable endpoint detection and response (EDR) systems, known collectively as the GentleKiller framework.
This framework is provided to affiliates to weaken system defenses before ransomware deployment. The RaaS operation has been observed to target approximately 400 security processes, indicating a sophisticated approach to evading detection. The development and distribution of these EDR-killing tools suggest a mature and persistent threat actor focused on maximizing the success rate of their ransomware attacks by neutralizing security measures.
The specific methods employed by GentleKiller to terminate these processes are part of an ongoing effort to stay ahead of evolving security software.
Sources and references
Original report
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00LCY313
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe