Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs

This report analyzes a high-risk operational incident where the ransomware group “The Gentlemen” used a zero-day vulnerable kernel driver (ktapi.sys) in a BYOVD attack to gain kernel code execution, bypass SMEP/SMAP and PatchGuard protections, and terminate protected EDR processes; the analysis includes technical walkthroughs, IOCs (driver and payload hashes, device names, filenames, and signatures), and practical mitigations such as enabling VBS/core isolation, WDAC, and vulnerable-driver blocklists.