Inside GentleKiller: The EDR-Killer Powering The Gentlemen

ESET’s investigation into The Gentlemen reveals that the ransomware group provides affiliates with a centralized EDR-killer suite (GentleKiller) comprising multiple BYOVD-based variants that impersonate legitimate drivers to disable hundreds of security processes, alongside third-party killers and a Rust-based credential stealer (OxideHarvest); the group targets victims selected via FortiGate misconfigurations, rapidly weaponizes public BYOVD PoCs, and the leak of internal data corroborated operator-managed distribution and attribution details.