cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

ESET Details GentleKiller Tools Used by Gentlemen Ransomware to Disable EDR

· Original article ↗

Summary

ESET says the Gentlemen ransomware group uses GentleKiller and other tools to disable EDR defenses. Its analysis describes BYOVD-based privilege escalation, targeting of more than 400 processes, and multiple tool variants.

Key points

  • ESET reports that GentleKiller has at least eight variants, some impersonating legitimate security products.
  • The variants use different vulnerable drivers to gain kernel-level privileges and disable security engines.
  • GentleKiller targets more than 400 processes associated with about 48 security vendors and products.
  • ESET found shared strings, code obfuscation, and process-killing logic across variants; the framework allows drivers to be swapped with limited code changes.
  • The group also uses external EDR-killing tools HexKiller, ThrottleBlood, and HavocKiller.
  • ESET documented OxideHarvest, a Rust-based credential stealer it believes was developed externally.
  • The article links the group to FortiGate-based targeting, a previous compromise of Romanian energy provider Oltenia, and a SystemBC proxy botnet.

Article Details

Attack Vectors
  • Gentlemen affiliates use EDR-killer tools early in attacks to disable security defenses. ESET reports that GentleKiller uses vulnerable drivers to obtain kernel-level privileges and disable security engines.
  • GentleKiller targets more than 400 processes associated with approximately 48 security vendors and products.
  • GentleKiller variants impersonate legitimate security products and use invalid stolen digital signatures, according to ESET.
  • The Gentlemen operation also uses HexKiller, ThrottleBlood, and HavocKiller; ESET documented OxideHarvest, a Rust-based credential-stealer tool, in connection with the activity.

MITRE ATT&CK

T1036 · MasqueradingGentleKiller variants impersonate legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog.T1068 · Exploitation for Privilege EscalationESET reports that GentleKiller variants use different vulnerable drivers to gain kernel-level privileges.T1562.001 · Disable or Modify ToolsGentleKiller disables security engines and targets security-related processes to impair EDR defenses.

Threat Actors

DragonForceThe article says ThrottleBlood is linked to DragonForce attacks.GentlemenThe article reports that the Gentlemen ransomware-as-a-service operation uses EDR killers and previously compromised Romanian energy provider Oltenia.MesudaLockerThe article says ThrottleBlood is linked to MesudaLocker attacks.WarlockThe article says HexKiller was previously used by the Warlock gang.

Malware

SystemBCESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.

Vendors

Bitdefendervendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.CrowdStrikemore than 400 processes associated with approximately 48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.ESETESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.KasperskyThe tool has at least eight variants and impersonates various legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog.McAfeesuch as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.Microsofttargets more than 400 processes associated with approximately 48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, andPalo Alto Networkswith approximately 48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.SentinelOneprocesses associated with approximately 48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.Sophoswith approximately 48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.Trellixsuch as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.Trend Micro48 security vendors/products, such as Microsoft, CrowdStrike, SentinelOne, Palo Alto, Sophos, Trend Micro, ESET, Bitdefender, McAfee/Trellix, and Kaspersky.

Products

Fortinet FortiGateESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.JavelinThe tool has at least eight variants and impersonates various legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog.KasperskyThe tool has at least eight variants and impersonates various legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog.ValorantThe tool has at least eight variants and impersonates various legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog.WatchDogThe tool has at least eight variants and impersonates various legitimate security products, including Kaspersky, Valorant, Javelin, and WatchDog.

Tools

EnigmaThe binaries for the EDR killer tool are protected by the commercial Enigma and Themida packing and code-protection tools.GentleKillerThe Gentlemen ransomware-as-a-service operation is actively maintaining a set of EDR killers, led by the GentleKiller tool, to help affiliates evade security defenses during attacks.HavocKillerESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.HexKillerESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.OxideHarvestThe group also uses external tools like HexKiller, ThrottleBlood, HavocKiller, and OxideHarvest.ThemidaThe binaries for the EDR killer tool are protected by the commercial Enigma and Themida packing and code-protection tools.ThrottleBloodESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.

Industries

EnergyESET says the group also uses external tools like HexKiller, ThrottleBlood, and HavocKiller, and has tied the activity to FortiGate-based targeting, the Romanian energy provider Oltenia, and a SystemBC proxy botnet.

Related Articles