Summary
ESET researchers have published a detailed analysis of The Gentlemen ransomware group’s industrialized approach to neutralizing endpoint security. The gang, led by Russian-speaking threat actor LARVA-368, has built a standardized EDR-killing suite that its affiliates deploy as part of every intrusion — targeting over 400 process names across 48 different security products.
The centerpiece of the toolkit is “GentleKiller,” which exists in at least eight variants designed to impersonate legitimate software and exploit various vulnerable or malicious kernel drivers via the Bring Your Own Vulnerable Driver (BYOVD) technique. The group also integrates third-party tools like HexKiller, ThrottleBlood, and HavocKiller through a shared defense-evasion layer that uses fake version information and legitimate-looking certificates.
Beyond EDR termination, The Gentlemen’s playbook includes disabling Microsoft Defender, deleting shadow copies and event logs, and removing forensic artifacts. The group operates on a RaaS model with an aggressive 90/10 split favoring affiliates, and targets Windows, Linux, NAS, BSD, and VMware ESXi environments. Initial access is typically gained through exploiting internet-exposed services like FortiGate VPNs or using compromised administrative credentials.
Source
Help Net Security — ESET: The Gentlemen EDR Killers · GovInfoSecurity — Gentlemen Ransomware Gang Standardizes EDR Killing
Commentary
This is a wake-up call for any SOC that treats EDR as the last line of defense. When a ransomware gang can ship a turnkey EDR-killer suite to affiliates that covers 48 security products out of the box, your endpoint agent is no longer a reliable sentinel — it’s a target. The BYOVD technique in particular continues to be devastatingly effective because it exploits legitimately signed drivers that Microsoft has been slow to blocklist.
Defenders need to adopt a layered approach: pair EDR with network detection, identity threat monitoring, and deception technologies. Monitor for driver loading anomalies, suspicious service installations, and shadow copy deletions. If your EDR agent goes silent, treat that silence as a critical alert, not a gap in telemetry.