'Gentlemen' Ransomware Abuses Vulnerable Driver to Kill Security Gear

The Gentlemen ransomware is seen weaponising a legitimate vulnerable driver, ThrottleStop.sys, to kill antivirus and other security products such as EDR, researchers say. In a BYOVD (bring-your-own-vulnerable-driver) attack, threat actors use the driver's kernel-level access to terminate protective processes and allow the ransomware to operate unhindered.

Trend Micro researchers cite CVE-2025-7771, a high-severity code execution and privilege-escalation flaw in ThrottleStop.sys, which was discovered while investigating a ransomware incident in Brazil and the renamed driver ThrottleBlood.sys used to disable defences. The gang has also deployed All.exe, an AV killer, and Allpatch2.exe, a customised version designed to stop key security components, with researchers noting their ability to adapt evasion tactics to the victim environment.

The report emphasises that ThrottleBlood.sys is digitally signed by DigiCert, complicating detection, and urges organisations to monitor for suspicious combinations of the driver with unknown executables. According to Trend Micro, The Gentlemen have shifted from generic bypass methods to targeted, bespoke tools and reconnaissance of endpoint security to tailor their approach.