ESET researchers analyzed the sturdy EDR-killing toolset of the ransomware-as-a-service gang Gents. Because the starting of 2026, Gents has emerged as probably the most energetic gangs within the ransomware ecosystem. The group distinguishes itself by means of a mature, operator-maintained set of endpoint detection and response (EDR) killers, i.e., instruments for disrupting safety software program. Moreover, not like most top-tier gangs, Gents doesn’t exhibit a powerful US-centric victimology, as a substitute focusing on victims throughout Southeast Asia, South America, and Western Europe.
Whereas there have been a number of reviews masking Gents in current months, they haven’t targeted on an in depth evaluation of the group’s EDR killers. Due to ESET’s continued incident-level visibility, we will nonetheless present a uniquely deep view into Gents’s EDR-killer growth practices. The inner information leak that Gents suffered in Might 2026 then gave us much more perception into the inside workings of the group.
The leak additionally allowed us to substantiate our speculation from February 2026 that Gents operators actively develop and keep a portfolio of EDR killers that they provide to associates, centered round their in-house framework now we have named GentleKiller. Additionally they incorporate third-party or leaked instruments equivalent to HexKiller, ThrottleBlood, and HavocKiller. These instruments are standardized by means of a shared defense-evasion layer, impersonating predominantly safety distributors utilizing faux model info, and copied legit certificates and icons. Gents additionally demonstrates a capability to unusually rapidly operationalize newly disclosed Deliver Your Personal Susceptible Driver (BYOVD) proofs-of-concept, usually inside days of public launch.
On this blogpost, we share our findings on Gents’s suite of EDR killers gained by means of in depth analysis and corroborated by the current leak. We intention to offer actionable insights by connecting the EDR killer packages to precise samples, and tying the leaked information to ways, strategies, and procedures (TTPs). Our findings spotlight Gents as probably the most technically agile ransomware-as-a-service (RaaS) gangs energetic in 2026.
Key factors of the blogpost:
- Gents operators develop and keep an EDR-killer suite supplied on to associates.
- GentleKiller is an in‑home framework with not less than eight variants abusing completely different susceptible or malicious drivers.
- Gents operators apply a unified evasion technique throughout instruments that standardizes impersonation and safety.
- Third‑celebration EDR killers (HexKiller, ThrottleBlood, and HavocKiller) are operationally built-in.
- Gents can quickly adapt newly launched EDR killer proofs-of-concept (PoCs).
- The gang’s victimology is globally distributed and notably not US‑targeted.
- Gents additionally makes use of OxideHarvest, a credential stealer maintained by one of many group’s associates.
All through this blogpost, we check with RaaS operators and associates.
Operators are chargeable for creating the ransomware payload, managing decryption keys, sustaining the devoted leak website, usually negotiating the ransom fee with victims, and providing different tooling and providers for a month-to-month charge or a proportion from the ransom fee (sometimes 5–20%).
Associates lease ransomware providers from operators, deploy encryptors to victims’ networks, and are additionally chargeable for information exfiltration.
Gents profile
Gents emerged in late 2025 as a RaaS operation and rapidly grew into probably the most energetic ransomware gangs noticed in Q1 2026. The gang affords a beneficiant 90% share to associates. Group-IB disclosed that Gents was based by hastalamuerte, a disgruntled former Qilin affiliate. PRODAFT tweeted on October 17th, 2025 that Gents operators have been beforehand associates of Qilin, Embargo, LockBit, Medusa, and BlackLock. On June 10th, 2026 Brian Krebs shared proof of hastalamuerte’s true id.
Gents makes use of double extortion – along with encrypting the sufferer information, the group additionally threatens to leak it if the ransom shouldn’t be paid. For encryption, the operators supply a variant written in Go focusing on Home windows, Linux, and different platforms, and an ESXi variant written in C.
One of many issues that units Gents aside is the gang’s willingness to supply extra than simply encryptors to associates – specifically, the gang additionally gives EDR killers. Current ESET analysis has proven that, in most ransomware intrusions, the duty for locating a dependable EDR killer sometimes falls on particular person associates, not the RaaS operators themselves. Solely a small variety of exceptions to this mannequin have been documented. One notable case is RansomHub, which invested in creating its personal EDR killer from scratch, EDRKillShifter, after which supplied it to associates by means of the affiliate panel.
Gents represents a special, and thus far underreported, strategy. Reasonably than counting on associates to supply their very own EDR killers, Gents operators actively develop and keep a portfolio of EDR killers for associates. This portfolio combines an in-house developed software, which we named GentleKiller, together with externally sourced or leaked tooling, standardized by means of a shared evasion layer and staged in a constant method.
ESET researchers hypothesized that GentleKiller was an inside software again in February 2026, and this was later supported by reviews from Group-IB and Verify Level – each point out that the gang gives EDR-killing capabilities to its (verified) associates. The not too long ago leaked inside information of the gang supplied the ultimate piece of proof: within the leaks, zeta88 (one other alias utilized by hastalamuerte), the chief of the gang, brazenly talks about sustaining and offering EDR-killer packages.
Other than confirming our suspicion about GentleKiller, the leaked information additionally allowed us to hyperlink a credential stealer we named OxideHarvest to Gents; particularly, to considered one of its associates.
Victimology
Whereas the victimology of huge RaaS operations is commonly formed extra by associates’ selections than by operator-led technique, one specific sample nonetheless tends to emerge. Most main ransomware gangs present a powerful and chronic give attention to america, which regularly accounts for roughly half of all introduced victims. This US-centric bias is clear throughout a number of outstanding teams, together with Qilin, DragonForce, and Akira, and has successfully turn out to be the norm amongst top-tier ransomware operations.
Gents stands out as a notable exception to this development. Regardless of rating among the many 5 most energetic ransomware gangs in Q1 2026, its victimology doesn’t exhibit a comparable US focus. As a substitute, Gents associates constantly goal victims throughout a broad and geographically various vary of nations, with a big variety of victims coming from areas equivalent to Southeast Asia, South America, and Western Europe. Certainly, the gang’s focusing on contains some in any other case uncommon international locations like Thailand, Brazil, and France.
The not too long ago leaked information gives proof that with regards to selecting victims, Gents makes use of a centralized strategy of sorting by means of viable candidates after which distributing them to associates. Victims are chosen based on their FortiGate (mis)configuration reasonably than their geographical location.
EDR Killers
In February 2026, we noticed a beforehand undocumented EDR killer deployed by a Gents affiliate and staged in a listing named GentlemenCollection. We named this software GentleKiller. On the time, we hypothesized that it was not an affiliate-specific artifact however reasonably a software supplied to associates by the Gents operators. Since then, now we have noticed the identical staging sample (dropping GentleKiller and different EDR killers to the GentlemenCollection listing) a number of occasions throughout unrelated intrusions that we investigated, constantly involving Gents associates. In parallel, two independently printed reviews by Group-IB and Verify Level assessed that the Gents operators explicitly supply EDR-disabling capabilities as a part of their RaaS program.
Taken collectively, these observations allowed us to conclude that GentleKiller is a element of an EDR-killer suite maintained by the Gents operators. This was later confirmed within the group’s leaked information.
Apart from GentleKiller, the suite additionally comprises HexKiller, HavocKiller, and ThrottleBlood; all ESET names for EDR killers utilized by associates of rival gangs too and obtained by Gents by way of unknown means. We additionally noticed DemoKiller in a number of intrusions, however this EDR killer didn’t exhibit any ties to Gents and subsequently we exclude it from the gang’s suite and as a substitute contemplate it affiliate-specific. The next a part of the blogpost covers these instruments in additional element and locations them into the broader EDR-killer ecosystem. Whereas these instruments are operationally built-in into Gents intrusions, we assess with excessive confidence that solely GentleKiller is developed in-house by the Gents operators, whereas the remaining EDR killers have been doubtless sourced externally and subsequently modified and standardized to suit the operators’ toolset. Our evaluation relies on:
- GentleKiller showing primarily in Gents-related intrusions, usually deployed to the GentlemenCollection listing,
- steady growth with clear entry to the supply code that enables creating new variants and supporting newly emerged PoCs, and
- third-party reporting mentioning Gents providing EDR-killing capabilities to trusted associates.
Protection evasion technique
Gents operators apply a particular set of protection evasion strategies to the gang’s numerous EDR killers. These strategies are utilized to compiled samples reasonably than supply code. This provides Gents the choice to guard even the EDR killers whose supply code the gang doesn’t possess.
All of the EDR killers which are a part of Gents’s portfolio comply with these defense-evasion patterns, which factors to a standardized technique, specifically:
- Superior binary safety (Enigma or Themida) is utilized to a good portion of the samples we detected. The filename suffix usually identifies the tactic used (Enigma, Themida, or none).
- Filenames are chosen to carefully resemble these of well-known software program distributors, notably firms working within the cybersecurity area.
- Executables impersonate the distributors by having the next attributes, all matching the identical vendor or product:
○ fabricated model info,
○ invalid digital signatures copied from legit executables, and
○ icons matching these of the impersonated distributors.
Though a small variety of samples deviate from this strategy, doubtless on account of inconsistent growth practices, the overwhelming majority of noticed EDR killers adhere to this sample. In Desk 1, we present how the suffixes work. Later within the blogpost, we clarify how the suffixes are appended to filenames.
Desk 1. Naming sample of the EDR killers maintained by Gents
| Suffix | Safety | Faux signature | Faux model info |
| 1 | Enigma | Sure | Sure |
| 2 | Themida | Sure | Sure |
| Mild | None | Sure | Sure |
| Clear | None | No | No |
GentleKiller
GentleKiller is by far essentially the most prevalent EDR killer noticed within the Gents ecosystem. On the time of writing, we’re conscious of not less than eight distinct variants, every impersonating a special legit product and abusing a special susceptible or malicious driver. Regardless of these surface-level variations, we classify all of those samples underneath the GentleKiller umbrella on account of a excessive diploma of shared inside traits.
When abstracting away the impersonation layer and the precise drivers used, the underlying code reveals quite a few structural and behavioral commonalities that strongly counsel the usage of a shared growth template. This template is reused throughout variants, with solely minimal modifications. The defining traits of the template embrace:
- constant strings throughout variants,
- terminating processes periodically in a loop,
- focusing on a broad set of safety options, and
- using similar code obfuscation.
An instance of GentleKiller’s output is illustrated in Determine 1, and a code snippet exhibiting the code obfuscation is depicted in Determine 2.
This design prioritizes ease of deployment and operational flexibility for associates, whereas minimizing growth effort for the operators. It permits the Gents operators to combine abused drivers into their toolset very quickly after an EDR killer PoC is disclosed. This was the case with UnknownKiller and PoisonKiller, which have been adopted inside a matter of days.
Whereas some builds don’t goal all of the processes recognized to GentleKiller, the overall set, supplied in Desk 2, is constant. We leveraged AI to map the method names to their corresponding distributors, and acknowledge that there is likely to be minor inconsistencies. Total, GentleKiller targets greater than 400 processes that the AI mapped to 48 merchandise.
Desk 2. A whole checklist of course of names focused by GentleKiller, mapped to their corresponding distributors
| Vendor | Focused processes |
| Acronis | acronis_agent.exe, BackupAndRecoveryAgent.exe, managementagenthost.exe, mms.exe |
| AlienVault | alienvault-agent.exe, osqueryd.exe |
| Avast | afwServ.exe, aswEngSrv.exe, aswidsagent.exe, aswToolsSvc.exe, AvastSvc.exe, AvastUI.exe, avastsvc.exe, avastui.exe, bccavsvc.exe, wsc_proxy.exe |
| AVG | AVGUI.exe, AVGSvc.exe, avgnt.exe, avgsvca.exe, avgToolsSvc.exe |
| Binary Protection | BinaryDefenseAgent.exe |
| Bitdefender | Arrakis3.exe, BDAvScanner.exe, BDFsTray.exe, BDFileServer.exe, BDLived2.exe, BDLogger.exe, BDScheduler.exe, BDStatistics.exe, bdagent.exe, bdemsrv.exe, bdntwrk.exe, bdredline.exe, bdregsvr2.exe, bdservicehost.exe |
| Blumira | BlumiraAgent.exe |
| Bromium | BromiumDaemon.exe, BrDifxapi.exe |
| Carbon Black | cb.exe, cbcomms.exe, cbdefense.exe, carbonsensor.exe, RepMgr.exe |
| Cisco Talos | cfrutil.exe, CiscoAMPCEFWDriver.exe, cisco_amp_connector.exe, immunet.exe |
| CrowdStrike | ARWSRVC.EXE, ARCUpdate.exe, CSFalconContainer.exe, CSFalconService.exe, CSFalconUI.exe, csfalcondataprotect.exe, csfalcondaterepair.exe, REPRSVC.EXE |
| Cynet | CynetEPS.exe, CynetMS.exe, CynetSvc.exe |
| Cybereason | ActiveConsole.exe, cybereason.exe, CybereasonActiveProbe.exe, CybereasonCR.exe |
| Cyvera | CyveraConsole.exe, CyveraService.exe, CyvrAgentSvc.exe, CyvrFsFlt.exe, cyvrfsflt.exe |
| Cylance/BlackBerry | CylanceSvc.exe |
| Darktrace | DarktraceTSA.exe |
| Deep Intuition | DeepInstinct.exe, DeepInstinctService.exe, DIAgentService.exe |
| Elastic | a2guard.exe, a2service.exe |
| ESET | eamonm.exe, eamsi.exe, ecls.exe, efwd.exe, egui.exe, eguiProxy.exe, ekrn.exe, ekrnEpfw.exe, ERAAgent.exe, EraAgentSvc.exe |
| Fortinet | firesvc.exe, firetray.exe, FortiTray.exe, fortiedr.exe, fw.exe |
| G DATA | GDDServer.exe, QHPISVR.EXE, QUHLPSVC.EXE, SAPISSVC.EXE |
| Heimdal | HeimdalsecurityAgent.exe |
| Huntress | HuntressAgent.exe, HuntressRMM.exe |
| Kaspersky | avp.exe, avpsus.exe, avpui.exe, kavfs.exe, kavfsscs.exe, kavfswh.exe, kavfswp.exe, kavtray.exe, klactprx.exe, klcsldcl.exe, klcsweb.exe, klnagent.exe, klnagchk.exe, klscctl.exe, klserver.exe, klwtblfs.exe, kpf4ss.exe, ksde.exe, ksdeui.exe, vapm.exe |
| LogRhythm | LogProcessorService.exe |
| McAfee/Trellix | AGMService.exe, AGSService.exe, masvc.exe, macmnsvc.exe, McAfeeAgent.exe, mcshield.exe, mfeann.exe, mfevtps.exe, mfetp.exe, mfeepehost.exe, mfefire.exe, mfemactl.exe, mfemacsvc.exe, mfemgr.exe, mfemms.exe, MgntSvc.exe, ModuleCoreService.exe, tepfsvc.exe |
| Microsoft Defender | MSASCui.exe, MSASCuiL.exe, MpDefenderCoreService.exe, MsMpEng.exe, MsMpSvc.exe, MsSense.exe, msascuil.exe, msseces.exe, NisSrv.exe, nissrv.exe, SecurityHealthService.exe, SecurityHealthSystray.exe, SenseCncProxy.exe, SenseIR.exe, SenseNdr.exe, SenseSampleUploader.exe, smartscreen.exe, windefend.exe |
| Morphisec | MorphisecService.exe |
| Norton/Symantec | ccApp.exe, ccSvcHst.exe, ccsvchst.exe, ns.exe, nsservice.exe, nortonsecurity.exe, rtvscan.exe, SepMasterService.exe, sepWscSvc64.exe, smc.exe, SmcGui.exe, snac.exe, SymCorpUI.exe, SymWSC.exe |
| OSSEC/Wazuh | ossec-agent.exe, wazuh-agent.exe |
| Palo Alto Networks (Traps/Cortex) | cortexService.exe, trapsagent.exe, trapsd.exe, Traps.exe |
| Panda Safety | panda_url_filtering.exe, pavfnsvr.exe, pavsrv.exe, psanhost.exe, PSANHost.EXE, pselamsvc.EXE, PSUAMain.EXE, PSUAService.EXE, pangps.exe |
| Qualys | qualys-cloud-agent.exe, QualysAgent.exe |
| Rapid7 | ir_agent.exe, rapid7_endpoint.exe |
| Crimson Canary | RedCanaryAgent.exe |
| Sangfor | CSAAgent.exe, CSAService.exe, SangforAgent.exe, SangforCSA.exe, SangforEDR.exe, SangforInterface.exe, SangforMonitor.exe, SangforProtect.exe, SangforService.exe, SangforTray.exe, SangforUD.exe |
| SentinelOne | Sentinel.exe, SentinelAgent.exe, SentinelAgentWorker.exe, SentinelCtl.exe, SentinelHelperService.exe, SentinelMemoryScanner.exe, SentinelPowerShellExtension.exe, SentinelRanger.exe, SentinelServiceHost.exe, SentinelStaticEngine.exe, SentinelStaticEngineScanner.exe, SentinelUI.exe |
| SonicWall | SonicWallClientProtectionService.exe, swc_service.exe |
| Sophos | hmpalert.exe, McsAgent.exe, McsClient.exe, SavApi.exe, SAVAdminService.exe, SAVService.exe, SEDService.exe, SophosADSyncService.exe, SophosClean.exe, SophosCleanM64.exe, SophosFIMService.exe, SophosFS.exe, SophosHealth.exe, SophosLiveQueryService.exe, SophosMTR.exe, SophosMTRExtension.exe, SophosNetFilter.exe, SophosNtpService.exe, SophosOsquery.exe, SophosOsqueryExtension.exe, Sophos.PolicyEvaluation.Service.exe, SophosSafestore64.exe, SophosUI.exe, SophosUpdateMgr.exe, sophosav.exe, sophossps.exe, SSPService.exe |
| Tanium | TaniumClient.exe, TaniumCX.exe, tanclient.exe |
| ThreatLocker | ThreatLockerConsent.exe, threatlockerservice.exe, threatlockertray.exe |
| TrendAI | coreFrameworkHost.exe, coreServiceShell.exe, NTRTScan.exe, ntrtscan.exe, Ntrtscan.exe, OfcService.exe, ofcDdaSvr.exe, PccNTMon.exe, PccNt.exe, TISafe.exe, TISafeSvc.exe, TmCCSF.exe, tmicAgentSetting.exe, TMBMSRV.exe, Tmbmsrv.exe, tm_netsrv.exe, TmListen.exe, tmntsrv.exe, TmPfw.exe, tmproxy.exe, TmProxy.exe, TmPreFilter.exe, TmSSClient.exe, TmsaInstance64.exe, TmWscSvc.exe, VOneAgentConsole.exe, VOneAgentConsoleTray.exe |
| Uptycs | VectorAgent.exe, UptycsAgent.exe |
| Varonis | DatAdvantage.exe, VaronisAgent.exe |
| WatchGuard | wlcsservice.exe |
| Webroot | WRSA.exe, WRSkyClient.exe, WRSVC.exe, wrsa.exe |
| Home windows Sysinternals | Sysmon.exe, Sysmon64.exe |
| Zscaler | zlclient.exe |
GentleKiller variants
Every GentleKiller variant impersonates a special product and abuses a special malicious or susceptible driver. Desk 3 gives an inventory of the eight GentleKiller variants now we have noticed thus far. The
Desk 3. Record of GentleKiller variants
| Variant identify | Filenames | Abused driver |
| Kaspersky | Kasp |
eb.sys, a rootkit (PoC) |
| FACEIT Anti-Cheat | FaceIT |
nseckrnl.sys, NSecsoft NSecKrnl driver (PoC) |
| Valorant | Valorant |
GameDriverX64.sys, an anti-cheat driver (PoC) |
| Javelin | EAAntiCheat EASolo |
stpm_(previous|new).sys, two susceptible ProcessMonitor Driver samples by Safetica (PoC) |
| WatchDog | BitD |
dmx.sys, Zemana’s WatchDog Antimalware Driver (PoC) |
| Community Blocker | MB |
360netmon_wfp.sys, a susceptible driver by Qihoo 360 Know-how (PoC) |
| Cleaner | Deletor.exe | IMFForceDelete, IObit’s IMF ForceDelete filter driver (PoC); the driving force is dropped with out the trailing .sys extension |
| G11 | G11 Symantec |
PoisonX, a rootkit (PoC) |
Third-party EDR killers
Other than the internally developed GentleKiller, Gents has integrated a number of third-party options into its suite, summarized in Desk 4 and described within the following sections. The
Desk 4. Record of third-party EDR killers supplied by Gents
| ESET identify for the EDR killer | Filenames | Abused driver |
| HexKiller | Avast |
googleApiUtil64.sys, Baidu Antivirus BdApi driver |
| ThrottleBlood | Despatched |
ThrottleBlood.sys, driver by TechPowerUp LLC |
| HavocKiller | HwAudKiller.exe Sophos |
havoc.sys, Huawei Audio driver |
HexKiller
HexKiller is an EDR killer that we beforehand assessed as being unique to the Warlock gang. Due to this fact, its look inside Gents intrusions is surprising and noteworthy.
We discovered HexKiller staged alongside GentleKiller binaries inside the GentlemenCollection listing. However, its presence in Gents intrusions doesn’t, by itself, suggest direct collaboration or operational overlap between the Gents and Warlock gangs. It’s believable that Gents operators obtained HexKiller by means of oblique means, equivalent to non-public exchanges, secondary distribution channels, or pattern leaks, with none want for direct interplay with Warlock. We subsequently don’t contemplate this to be proof of a deeper relationship between the 2 teams.
ThrottleBlood
This EDR killer has been repeatedly noticed in intrusions carried out by MedusaLocker associates, and, much less regularly, by DragonForce associates. Moreover, it was linked to Gents by Pattern Micro in September 2025.
At current, we don’t have adequate proof to conclusively decide the origin of ThrottleBlood. In our telemetry, it seems prominently deployed throughout a number of MedusaLocker intrusions and sporadically in DragonForce-related exercise. These incidents present little operational overlap past the usage of ThrottleBlood itself. One attainable clarification is that ThrottleBlood is commercially distributed on underground markets, or alternatively a software developed by MedusaLocker operators and shared with their associates, a few of whom can also have ties to DragonForce.
Neither speculation, nonetheless, totally explains how a ThrottleBlood pattern appeared in Gents’s possession. Consequently, we can’t rule out the potential for Gents buying the software by means of it leaking past the initially supposed context. What we state with excessive confidence, nonetheless, is that Gents didn’t develop this EDR killer in-house.
HavocKiller
HavocKiller is the ultimate addition to Gents’s EDR-killer arsenal. Whereas the software was publicly disclosed by Huntress on March 19th, 2026, ESET telemetry confirms its use in real-world intrusions courting again to not less than January 23rd, 2026, indicating that it had been operational for weeks previous to public reporting. We are able to additionally corroborate Huntress’s evaluation relating to its objective: in all circumstances noticed by ESET, the deployment of HavocKiller was a part of ransomware-related exercise.
Based mostly on its technical traits, we assess that HavocKiller shouldn’t be developed by the Gents operators themselves, however as a substitute was obtained by means of exterior means. Though the samples have been staged inside the GentlemenCollection listing and Gents’s customary set of protection evasion strategies was utilized to them, the underlying implementation differs considerably from GentleKiller. This strongly means that HavocKiller represents a third-party EDR killer that was tailored operationally, however its structure doesn’t match into Gents’s framework.
OxideHarvest
We additionally detected a number of deployments of a software we named OxideHarvest, a credential stealer written in Rust. Since Rust shouldn’t be the programming language of selection for Gents, we don’t attribute the software to the group. Nevertheless, as Verify Level famous, a Gents affiliate named quant maintains a software known as buildx641, whose naming and performance instantly reminded us of OxideHarvest. Certainly, after additional investigation, we discovered an OxideHarvest pattern named buildx641.exe uploaded to VirusTotal; we conclude that buildx641 and OxideHarvest are the identical software.
OxideHarvest comes wrapped inside completely different packers, usually mimicking legit software program in model info and icon (related, however not similar, to what Gents does with GentleKiller). The protected payload is an easy, simple credential stealer. To perform, OxideHarvest requires the person to specify the checklist of hosts (-i), username (-u), password (-p), variety of threads (-t), and an output file (-o) as command line choices. The software then makes use of the equipped credentials to log into the required hosts (handed as a newline-delimited textual content file), employs multithreading, and exfiltrates credentials into the equipped output file. Determine 9 exhibits the results of the –help command of OxideHarvest, and Desk 5 exhibits its configuration dictating which credentials are focused.
Desk 5. Embedded configuration of OxideHarvest
{
"chronium_browsers": [
[
"Google Chrome",
"GoogleChromeUser Data",
true
],
[
"Google Chrome Beta",
"GoogleChrome BetaUser Data",
true
],
[
"ChromeBeta",
"GoogleChrome SxSUser Data",
true
],
[
"Chromium",
"ChromiumUser Data",
true
],
[
"Microsoft Edge",
"MicrosoftEdgeUser Data",
true
],
[
"Torch",
"TorchUser Data",
true
],
[
"Comodo",
"ComodoDragonUser Data",
true
],
[
"Nichrome",
"NichromeUser Data",
true
],
[
"Maxthon5",
"Maxthon5Users",
true
],
[
"Epic Privacy Browser",
"Epic Privacy BrowserUser Data",
true
],
[
"Vivaldi",
"VivaldiUser Data",
true
],
[
"QIP",
"QIP SurfUser Data",
true
],
[
"Cent",
"CentBrowserUser Data",
true
],
[
"Elements",
"Elements BrowserUser Data",
true
],
[
"TorBro",
"TorBroProfile",
true
],
[
"CryptoTab",
"CryptoTab BrowserUser Data",
true
],
[
"Brave",
"BraveSoftwareBrave-BrowserUser Data",
true
],
[
"Opera",
"Opera SoftwareOpera Stable",
false
],
[
"OperaGX",
"Opera SoftwareOpera GX Stable",
false
],
[
"Opera Neon",
"Opera SoftwareOpera NeonUser Data",
false
]
],
"gecko_browsers": [
[
"Mozila Firefox",
"MozillaFirefoxProfiles",
false
],
[
"Slim",
"FlashPeakSlimBrowserProfiles",
false
],
[
"PaleMoon",
"Moonchild ProductionsPale MoonProfiles",
false
],
[
"Waterfox",
"WaterfoxProfiles",
false
],
[
"Cyberfox",
"8pecxstudiosCyberfoxProfiles",
false
],
[
"BlackHawk",
"NETGATE TechnologiesBlackHawkProfiles",
false
],
[
"IceCat",
"MozillaicecatProfiles",
false
],
[
"KMeleon",
"K-Meleon",
false
]
]
}Conclusion
Gents demonstrates an fascinating strategy: operator-managed EDR killers, prepared to make use of by associates. Whereas most ransomware gangs proceed to delegate EDR killing to associates, Gents has chosen to centralize this perform by providing associates a ready-to-use, standardized EDR-killer suite. This resolution makes Gents a lovely operator for associates because it materially lowers the entry barrier for them, making their job consequently simpler.
This mannequin differs even from the few recognized exceptions within the ecosystem. Within the case of RansomHub, the operators invested in a single EDR killer, EDRKillShifter, developed completely in-house. Gents, against this, maintains a various portfolio of EDR killers, mixing authentic growth (GentleKiller) with quickly tailored third-party or publicly disclosed tooling (HexKiller, ThrottleBlood, and HavocKiller). The constant utility of protection evasion strategies throughout these instruments additional obscures and complicates simple attribution when samples are noticed in isolation.
As a result of EDR-killer strategies proceed to commoditize and flow into throughout underground communities, this blogpost underscores the need of incident-level investigation and evaluation. With out such context, Gents’s EDR killers are prone to be misattributed, or not attributed in any respect, masking the true extent of this operator’s involvement. Due to our steady perception into Gents intrusions, we have been in a position to present safety towards the group’s assaults months earlier than the not too long ago leaked information confirmed our high-confidence hypotheses on the gang’s EDR-killer suite.
The GentleKiller framework illustrates a deliberate stability between in-house growth and pragmatic reuse of exterior analysis. Whereas some parts present indicators of rushed implementation or inconsistent polish, the general toolset demonstrates excessive operational effectiveness and tight integration into Gents’s ransomware workflow. The group’s potential to adapt newly printed BYOVD PoCs inside days additional underscores its agility.
From a protection perspective, understanding how GentleKiller works permits defenders to raised design their defensive methods and defend even towards yet-to-be-developed, new additions to Gents’s EDR-killing arsenal.
For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.ESET Analysis affords non-public APT intelligence reviews and information feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.
IoCs
Information
| SHA-1 | Filename | Detection | Description |
| 8AE6BD18B129061F6364 |
Kasps.exe | Win64/KillAV.EA | GentleKiller (Kaspersky variant). |
| BA914FE77B177B457994 |
eb.sys | Win64/Agent.ITG | A customized rootkit utilized by the Kaspersky variant of GentleKiller. |
| D605994FC72A2BB59B5C |
FaceIT1.exe | Win64/KillAV.EA | GentleKiller (FACEIT Anti-Cheat variant, Enigma-protected). |
| B0B912A3FD1C05D72080 |
nseckrnl.sys | Win64/VulnDriver |
NSecsoft NSecKrnl driver abused by the FACEIT Anti-Cheat variant of GentleKiller. |
| 5AA3124E5C4921E5EDFC |
Valorant2.exe | Win64/KillAV.EA | GentleKiller (Valorant variant, Themida-protected). |
| 7556AE58C215B8245A43 |
vgk.sys | Win64/VulnDriver |
Tower of Fantasy AntiCheat driver abused by the Valorant variant of GentleKiller. |
| 331879F5EEC8892BBD89 |
EASolo2Light.exe | Win64/KillAV.EA | GentleKiller (Javelin variant abusing Safetica’s newer driver). |
| F11AEBCCB9A86A7E2E65 |
EASOLO1clear.exe | Win64/KillAV.EA | GentleKiller (Javelin variant abusing Safetica’s older driver). |
| EF9CD06683159397F099 |
EAAntiCheatLight |
Win64/KillAV.EA | GentleKiller (Javelin variant abusing each drivers). |
| 711EF221526997039E80 |
stpm_old.sys | Win64/VulnDrive |
Safetica’s Course of Monitor Driver (older) abused by the Javelin variant of GentleKiller. |
| 68FEC379F2AE76C3D2CE |
stpm_new.sys | Win64/VulnDrive |
Safetica’s Course of Monitor Driver (newer) abused by the Javelin variant of GentleKiller. |
| A11EE9CDC59E5CAA59AE |
BitD1.exe | Win64/KillAV.EA | GentleKiller (WatchDog variant, Themida-protected). |
| 96F0DBF52AED0AFD43E4 |
dmx.sys | Win64/VulnDrive |
Zemana’s WatchDog Antimalware Driver abused by the WatchDog variant of GentleKiller. |
| 2F86898528C6CAB3540C |
MB2.exe | Win64/KillAV.EA | GentleKiller (Community Blocker variant, Themida-protected). |
| 9AD51AD97C01E97AB592 |
360netmon_wfp.sys | Win64/VulnDrive |
360netmon.sys driver abused by the Community Blocker variant of GentleKiller. |
| A19117175DBC9BA4D23B |
Deletor.exe | Win64/KillAV.EA | GentleKiller (Cleaner variant). |
| 12500F6C87CE62712A0E |
IMFForceDelete | Win64/VulnDrive |
IMF ForceDelete filter driver abused by the Cleaner variant of GentleKiller. |
| D29670E684E40DDC89B4 |
Symantec.exe | Win64/KillAV.EA | GentleKiller (G11 variant). |
| 56BEE9DF5833A637F5C5 |
G11.sys | Win64/Agent.IYQ | PoisonX rootkit utilized by the G11 variant of GentleKiller. |
| CF4D74DF17A91B4A36A2 |
Avast.exe | Win32/KillAV.NVL | HexKiller integrated into Gents modus operandi by including the evasion layer. |
| EC296F9501AD71E43081 |
googleApiUtil64 |
Win64/VulnDrive |
Baidu Antivirus BdApi driver abused by HexKiller. |
| 7131B377E96016DC1911 |
Despatched.exe | Win64/KillAV.AT | ThrottleBlood integrated into Gents modus operandi by including the evasion layer. |
| 82ED942A52CDCF120A89 |
ThrottleBlood.sys | Win64/VulnDrive |
ThrottleStop.sys driver abused by ThrottleBlood. |
| F0537CBB773AE12100B3 |
Sophos.exe | Win64/KillAV.DE | HavocKiller integrated into Gents modus operandi by including the evasion layer. |
| 1FA071303FB846308571 |
havoc.sys | Win64/VulnDrive |
Susceptible driver abused by HavocKiller. |
| A5CF917EC4A7DFBDFA43 |
buildx641.exe | Win64/Spy.Agent.AGC | OxideHarvest. |
| D4B19141102015D43632 |
buildx64.exe | Win64/Spy.Agent.AGC | OxideHarvest. |
MITRE ATT&CK strategies
This desk was constructed utilizing model 19 of the MITRE ATT&CK framework.
| Tactic | ID | Title | Description |
| Execution | T1059.003 | Command and Scripting Interpreter: Home windows Command Shell | GentleKiller and associated instruments are console-based executables that run visibly and emit debug strings throughout execution. |
| T1106 | Native API | Person-mode parts work together immediately with kernel drivers by way of DeviceIoControl and different native Home windows APIs to carry out privileged actions. | |
| Persistence | T1543.003 | Create or Modify System Course of: Home windows Service | The EDR killers set up and begin susceptible or malicious drivers as providers previous to exploitation. |
| Stealth | T1036 | Masquerading | Gents’s EDR killers are protected by impersonating legit distributors by means of filenames, model info, icons, and copied digital certificates. |
| T1036.001 | Masquerading: Invalid Code Signature | The safety utilized to Gents’s EDR killers provides an invalid code signature as a part of the impersonation technique. | |
| T1027 | Obfuscated Information or Data | Some executables are protected with packers (e.g., Enigma, Themida) and customized control-flow obfuscation. | |
| Protection Impairment | T1685 | Disable or Modify Instruments | GentleKiller and different EDR killers that Gents is in possession of intention to bypass safety merchandise equivalent to EDRs. |
![How creators and entrepreneurs are utilizing AI to hurry up & succeed [data]](https://blog.aimactgrow.com/wp-content/uploads/2025/06/Untitled20design-Apr-07-2023-08-24-35-4586-PM-120x86.png)
