ESET Details The Gentlemen Ransomware Group’s EDR-Killer Suite
Summary
ESET reports that The Gentlemen supplies affiliates with EDR-killing tools, including eight GentleKiller variants that abuse vulnerable drivers. It also identified the browser-data stealer OxideHarvest and noted rapid adoption of BYOVD exploits.
Key points
- ESET says The Gentlemen provides affiliates with a standardized suite for disabling security defenses before ransomware deployment.
- GentleKiller has eight variants that abuse different drivers and target 400 processes associated with 48 security programs.
- ESET reports that the group can operationalize newly disclosed BYOVD proof-of-concept exploits within days.
- The suite includes third-party tools HexKiller, ThrottleBlood, and HavocKiller/HwAudKiller; ESET describes shared vendor-impersonation techniques.
- ESET detected OxideHarvest, a Rust-based stealer capable of harvesting data from popular web browsers.
- Separately, CERT/CC warned that vulnerable vendor-signed UEFI applications could enable Secure Boot bypass and recommended DBX updates to revoke trust in affected binaries.
Article Details
- Event Type
- The Gentlemen ransomware operation's standardized EDR-killer suite, alongside a separate Secure Boot bypass advisory
- Impact
- The Gentlemen provides affiliates with tools including GentleKiller to terminate security processes before ransomware deployment; GentleKiller targets 400 processes associated with 48 security programs. ESET also detected OxideHarvest, a credential stealer capable of harvesting browser data. Separately, CERT/CC warned that affected vendor-signed UEFI applications could allow attackers with administrative privileges or physical access to execute code before the operating system starts; it recommended updating the UEFI Forbidden Signature Database (DBX). Ransomware.live data cited in the article says The Gentlemen has claimed 504 victims, mostly in Southeast Asia, South America, and Western Europe.
MITRE ATT&CK
T1211 · Exploitation for StealthThe Gentlemen's EDR killers use vulnerable drivers in BYOVD attacks to impair security defenses.T1555.003 · Credentials from Web BrowsersOxideHarvest is described as a credential stealer that harvests data from web browsers.T1562.001 · Disable or Modify ToolsGentleKiller and related tools terminate security processes and EDR products.
People
Threat Actors
Alexander Andreevich YapaevReported by Brian Krebs and PRODAFT to be leading The Gentlemen operation; the article describes him as a 36-year-old Russian national and former affiliate of other ransomware schemes.hastalamuerteIdentified in the article as an alias of Alexander Andreevich Yapaev, who was reported by Brian Krebs and PRODAFT to be leading The Gentlemen operation.The GentlemenRansomware group operating a RaaS service and providing affiliates with a standardized EDR-killer suite. Ransomware.live data cited by the article says the group has claimed 504 victims.
Malware
Vendors
AcerThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.AMDThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.AsusThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.ECSThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.GetacThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.GIGABYTEThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.ToshibaThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.UniwillThe impacted applications are from Acer, AMD, ASUS, ECS, Getac, GIGABYTE, Toshiba, and Uniwill.
Tools
GentleKillerransomware group is distributing a standardized suite of EDR-killing tools to affiliates, centered on GentleKiller and supported by leaked or third-party utilities such as HexKiller, ThrottleBlood, and HavocKiller.HavocKilleron GentleKiller and supported by leaked or third-party utilities such as HexKiller, ThrottleBlood, and HavocKiller.HexKillertools to affiliates, centered on GentleKiller and supported by leaked or third-party utilities such as HexKiller, ThrottleBlood, and HavocKiller.ThrottleBloodcentered on GentleKiller and supported by leaked or third-party utilities such as HexKiller, ThrottleBlood, and HavocKiller.