Gentlemen ransomware uses multiple EDR killers to disable defenses

Gentlemen ransomware-as-a-service (RaaS) actively uses a suite of EDR-killing tools—most prominently a multi-variant tool named GentleKiller that impersonates legitimate security products—to disable endpoint defenses via 'bring your own vulnerable driver' (BYOVD) techniques, often leveraging stolen digital signatures and commercial packers; the actor also employs additional external killers (HexKiller, ThrottleBlood, HavocKiller) and a Rust-based credential stealer (OxideHarvest), targets many security vendor processes, and has been linked to prior compromises and a SystemBC proxy botnet.