The contemporary Ransomware-as-a-Service (RaaS) paradigm is undergoing a profound structural shift, characterized by operators expanding beyond simple encryption payload delivery into providing advanced endpoint subversion architectures. Historically, the responsibility for neutralizing Endpoint Detection and Response (EDR) solutions was delegated solely to initial access brokers or specific threat actors working as affiliates. However, the emergence of the “Gentlemen” RaaS group in late 2025 and early 2026 marks a pivotal shift toward operator-maintained defense-evasion suites. Founded by an actor known as hastalamuerte (a disgruntled former Qilin affiliate), Gentlemen has rapidly ascended the ranks of the threat landscape. A key catalyst for their operational efficacy is a dedicated EDR-killing toolkit distributed systematically to their affiliate network, minimizing the technical barrier for deployment and ensuring immediate threat containment inside targeted infrastructures.
The Strategic Shifts in Ransomware Victimology and Governance
Unlike traditional top-tier cybercrime syndicates that display a pronounced US-centric targeting bias, Gentlemen maintains a distinct, globally distributed footprint. Analysis of their victimology reveals a strategic focus spanning Southeast Asia, South America, and Western Europe, with notable compromises documented in nations such as Thailand, Brazil, and France. Internal data leaked in May 2026 uncovered a highly centralized governance model wherein operators curate potential targets primarily based on perimeter vulnerabilities—specifically FortiGate appliance misconfigurations—rather than geographic criteria. These validated network entry points are subsequently distributed to vetted affiliates alongside pre-packaged tools, illustrating an industrialized division of labor designed to optimize initial access monetization.
Deconstructing GentleKiller: The In-House EDR Evulsion Framework
At the core of the group’s infrastructure lies GentleKiller, a highly modular, internally developed framework explicitly engineered to execute Bring Your Own Vulnerable Driver (BYOVD) attacks. ESET researchers have identified at least eight distinct variants of GentleKiller, each tailored to leverage a unique vulnerable or malicious kernel driver (such as those associated with Safetica software) to acquire arbitrary kernel-mode execution privileges. While the external wrapper and the weaponized drivers change, the core execution code relies on a standardized code template. This template maintains consistent string constants, operates continuous loop-based process termination routines, and utilizes identical code obfuscation techniques to mask API calls. This structural uniformity allows the operators to achieve rapid operational agility; upon the public disclosure of a new BYOVD proof-of-concept (PoC)—such as UnknownKiller or PoisonKiller—Gentlemen can integrate the driver and weaponize a new variant within days, bypassing contemporary kernel-level protections by systematically terminating the user-mode services of dominant security agents.
The Standardized Evasion Architecture and Binary Wrapping Modalities
A defining characteristic of Gentlemen’s development lifecycle is the implementation of a uniform defense-evasion layer applied directly to compiled binaries rather than at the source code level. This post-compilation hardening technique enables the operators to secure both in-house code and externally acquired assets against static analysis and automated detection mechanisms. The group relies heavily on commercial packers and protectors, specifically Enigma and Themida, and employs a strict file-naming suffix convention to track operational modifications. Artifacts appended with suffix 1 signify Enigma packing, suffix 2 denotes Themida application, while Light represents unpacked variants containing falsified signature and version details. The Clear suffix designates completely unprotected baselines. To further obfuscate security teams, these binaries aggressively masquerade as legitimate software applications, embedding fabricated version info, invalid digital certificates cloned from legitimate vendors, and identical application icons to slip past casual administrative inspections.
Incorporation of Third-Party Armaments: HexKiller, ThrottleBlood, and HavocKiller
To complement GentleKiller, the operators have systematically integrated several notable third-party EDR killers into their centralized GentlemenCollection deployment directories. Among these integrated utilities is HexKiller—an EDR utility previously attributed exclusively to the Warlock threat group—which abuses the Avast (googleApiUtil64.sys) and Baidu Antivirus (BdApi) drivers. Additionally, the suite features ThrottleBlood, a tool frequently utilized by MedusaLocker and DragonForce affiliates that abuses kernel drivers signed by TechPowerUp LLC. Lastly, HavocKiller, which weaponizes a vulnerable Huawei Audio driver (havoc.sys), was deployed by Gentlemen affiliates weeks before its public disclosure by Huntress in March 2026. The technical architecture of these three tools differs drastically from GentleKiller’s unified template, indicating that Gentlemen operators acquired them via underground leaks or private cross-group channels, subsequently applying their standardized binary wrapping and impersonation layers to homogenize the toolkit.
Auxiliary Cyber-Espionage Components: The OxideHarvest Credential Stealer
The leaked internal data also shed light on auxiliary software components deployed alongside their primary ransomware pipelines, notably a specialized credential harvesting utility named OxideHarvest. Developed in the Rust programming language, OxideHarvest deviates from the standard Go and C configurations favored by Gentlemen’s core development team. Threat intelligence tracking has linked the maintenance of this tool to a prominent affiliate operating under the moniker quant. The utility is frequently compiled and staged under the artifact name buildx641.exe. While not directly authored by the core RaaS operators, its persistent inclusion within tactical deployments highlights how highly specialized affiliate tooling is absorbed into the broader ecosystem, creating a symbiotic environment where credential harvesting and endpoint subversion seamlessly pave the way for the final deployment of the ransomware payload.
Our Opinion on the Gentlemen Case
The Gentlemen RaaS operation represents a watershed moment in the professionalization of cybercrime infrastructure. By shifting the burden of EDR evasion from affiliates to a centralized operator framework, the group has effectively commoditized advanced kernel-level subversion. The inclusion of an in-house tool like GentleKiller alongside standardized third-party utilities demonstrates a sophisticated supply-chain approach to malware development.
What makes Gentlemen particularly dangerous is their extreme operational agility, demonstrated by their ability to weaponize zero-day or newly disclosed BYOVD vulnerabilities within days. This rapid turnaround time exposes a severe gap in corporate defensive strategies; traditional patch management cycles are simply too slow to counter adversaries who immediately weaponize disclosed driver bugs. Furthermore, their opportunistic targeting based on FortiGate perimeter misconfigurations rather than geographic location proves that network hygiene remains the primary line of defense.
Moving forward, organizations can no longer rely purely on user-mode EDR agents that can be easily blinded by kernel-mode drivers. Defending against such agile threats requires strict driver blocklisting, robust credential guardrails, and automated perimeter vulnerability scanning. The Gentlemen case is a stark reminder that cybercriminals are operating with the efficiency of modern enterprise software vendors.
