ESET research reveals that The Gentlemen, a major ransomware-as-a-service group, has integrated a custom EDR killer framework called 'GentleKiller' into its platform, giving affiliates ready-made tools to disable enterprise endpoint security products. The framework uses bring-your-own-vulnerable-driver (BYOVD) techniques to gain kernel-level privileges and targets processes from 400 EDR products across 48 vendors. By lowering the technical barrier for affiliates, the group expands its pool of attackers and enables more consistent ransomware deployment. Defenses recommended include enforcing HVCI and KMCI protections, strict driver allow/block policies, and removing or updating vulnerable drivers.
38 Impressions