---
title: "Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform"
url: https://daily.dev/posts/threat-actor-adds-advanced-edr-killer-tools-to-ransomware-as-a-service-platform-vgthonbtl
source_url: https://www.csoonline.com/article/4187329/threat-actor-adds-advanced-edr-killer-tools-to-ransomware-as-a-service-platform.html
type: article
source: "CSO Online"
published: 2026-06-19T20:12:13.511Z
updated: 2026-06-19T20:40:12.556Z
tags: ["malware", "ransomware"]
reading_time: 4
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform

**[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments

## Summary

ESET research reveals that The Gentlemen, a major ransomware-as-a-service group, has integrated a custom EDR killer framework called 'GentleKiller' into its platform, giving affiliates ready-made tools to disable enterprise endpoint security products. The framework uses bring-your-own-vulnerable-driver (BYOVD) techniques to gain kernel-level privileges and targets processes from 400 EDR products across 48 vendors. By lowering the technical barrier for affiliates, the group expands its pool of attackers and enables more consistent ransomware deployment. Defenses recommended include enforcing HVCI and KMCI protections, strict driver allow/block policies, and removing or updating vulnerable drivers.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.csoonline.com/article/4187329/threat-actor-adds-advanced-edr-killer-tools-to-ransomware-as-a-service-platform.html>

## Similar posts on daily.dev

- [Gentlemen ransomware uses multiple EDR killers to disable defenses](https://daily.dev/posts/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses-w7uzuevxr) · BleepingComputer · 0 upvotes · 0 comments
- [How the GodDamn Ransomware Driver Bypasses Your EDR](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) · Latest Hacking News · 0 upvotes · 0 comments
- [Ransomware upstart ‘The Gentlemen’ raises the stakes for OT‑heavy sectors](https://daily.dev/posts/ransomware-upstart-the-gentlemen-raises-the-stakes-for-ot-heavy-sectors-55gisoqax) · CSO Online · 0 upvotes · 0 comments

---

Tags: [#malware](https://daily.dev/tags/malware), [#ransomware](https://daily.dev/tags/ransomware)

[View this post on daily.dev](https://daily.dev/posts/threat-actor-adds-advanced-edr-killer-tools-to-ransomware-as-a-service-platform-vgthonbtl)