Gentlemen ransomware's GentleKiller: 8 BYOVD EDR killers targeting 48 security products
ESET found Gentlemen RaaS gives affiliates GentleKiller, 8+ BYOVD variants that kill 400+ processes from 48 security products. What to block and monitor.
ESET researchers have documented GentleKiller, an in-house suite of EDR killers that the Gentlemen ransomware-as-a-service (RaaS) operation gives its affiliates. Each variant loads a vulnerable or malicious Windows kernel driver to switch off security tools before encryption starts. For anyone responsible for Windows servers or developer workstations, the question to ask is which kernel drivers your fleet is allowed to load.
What happened
On 18 June 2026, ESET published "Killing me gently: Inside Gentlemen's EDR killer framework" by researcher Jakub Souček. ESET found at least eight GentleKiller variants. Each one impersonates a different legitimate product and drops a different driver:
- "Kaspersky" variant:
eb.sys - "FACEIT" anti-cheat:
nseckrnl.sys - "Valorant":
GameDriverX64.sys - "Javelin": Safetica's
stpm_old.sys/stpm_new.sys - "WatchDog":
dmx.sys; "Network Blocker":360netmon_wfp.sys; "Cleaner":IMFForceDelete.sys; "G11":PoisonX.sys
Together, the variants target more than 400 processes, which ESET mapped to 48 security products. The binaries are packed with Enigma or Themida and carry fake names, version information, signatures and icons. Gentlemen has also integrated third-party EDR killers, including HexKiller, ThrottleBlood and HavocKiller, and ships OxideHarvest, a Rust-based browser credential stealer. ESET says the group adopts newly published BYOVD proofs of concept within days. Separately, Xcitium documented PoisonX being used to kill CrowdStrike Falcon. The Gentlemen operation appeared in March 2025, and Ransomware.live listed 504 claimed victims at the time of The Hacker News report.
Who is affected
- Windows endpoints and servers where an attacker already has administrator rights. BYOVD is used after initial access, not as the way in.
- Organisations running any of the 48 targeted EDR/AV products. ESET's list spans many vendors, so no single product is safe by default.
- Teams that allow arbitrary signed drivers, including developer machines with game anti-cheat, hardware utilities or old vendor tools installed.
What it means for developers and engineering teams
Bring-your-own-vulnerable-driver (BYOVD) works because Windows will load a validly signed kernel driver even if that driver has a known flaw. The attacker installs the driver as a service (MITRE T1543.003) and calls it from user mode with DeviceIoControl. A vulnerable IOCTL handler then does privileged work on the attacker's behalf, such as opening and terminating protected EDR processes from ring 0, where user-mode self-protection can't stop it. Once the EDR is dead, encryption and credential theft run unobserved.
Two things make this matter beyond the SOC. First, a driver that was signed and harmless when it shipped can become a weapon once someone finds a bug in it. Gaming anti-cheat and hardware-utility drivers keep turning up in these kits. Second, the time from public PoC to criminal use is now days, so blocklist updates have to be automatic. Developer laptops deserve particular attention. They often have local admin rights, hardware-vendor utilities and gaming software installed, and they hold source code, cloud credentials and CI tokens. That combination makes a developer machine a good starting point for an affiliate who wants to switch off EDR before moving through the rest of the network. A related CERT/CC advisory (VU#457458) on vendor-signed UEFI applications that allow Secure Boot bypass shows the same signed-but-vulnerable problem at the firmware level.
What to do now
- Turn on the Microsoft Vulnerable Driver Blocklist (Windows Security → Device security → Core isolation), and enable HVCI/Memory Integrity where hardware supports it.
- Use WDAC or App Control for Business policies that allow only the drivers your fleet actually needs.
- Hunt for new kernel-driver services: Windows event 7045 or Sysmon event 6 (driver loaded), where the driver name matches the list above or the path is in a user-writable directory.
- Import ESET's IoCs (SHA-1 hashes and detection names such as Win64/KillAV.EA) into your EDR or SIEM.
- Alert when EDR agents stop reporting. Losing an agent's heartbeat is often the only sign of BYOVD.
- Reduce standing local admin rights. BYOVD needs admin, so tiered admin accounts and LAPS raise the cost.
- Apply UEFI DBX updates covering the vendors listed in CERT/CC VU#457458.
Related on TechLogHub
- Depna: dependency vulnerability scanning
- Authorization: least privilege limits what BYOVD can reach