Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

Gentlemen ransomware uses GentleKiller to disable security tools

Part of the The Gentlemen story · since 11 Sep 2025

Developinglatest 8 hours ago44 articles14 outlets
11 Sep · SecurityOnline first10 Apr21 Jun1 SepNowThis article26th of 44
  • Thu 11 Sep, 00:40 UTC. SecurityOnline, first report. The Gentlemen: A New Ransomware Group Using Legitimate Tools to Bypass Security.
  • Wed 29 Oct, 12:55 UTC. GBHackers, its first report on the story. New ‘Gentlemen’ RaaS Appears on Hacking Forums, Targeting Windows, Linux and ESXi.
  • Thu 20 Nov, 02:01 UTC. SecurityOnline. Sophisticated “The Gentlemen” Ransomware RaaS Emerges with XChaCha20 Encryption and 48 Victims in 3 Months.
  • Wed 17 Dec, 01:41 UTC. SecurityOnline. Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics.
  • Thu 12 Feb, 14:40 UTC. SOCRadar, its first report on the story. Dark Web Profile: The Gentlemen Ransomware.
  • Thu 19 Mar, 16:05 UTC. Infosecurity, its first report on the story. Ransomware Affiliate Exposes Details of 'The Gentlemen' Operation.
  • Mon 20 Apr, 13:21 UTC. Check Point, its first report on the story. Gentlemen RaaS adds ESXi locker, infects 320+ victims worldwide.
  • Tue 21 Apr, 14:21 UTC. Infosecurity. The Gentlemen ransomware hits 320 victims amid affiliate boom.
  • Tue 21 Apr, 20:01 UTC. The Hacker News, its first report on the story. Check Point links Gentlemen to SystemBC botnet of 1.5k victims.
  • Wed 22 Apr, 21:51 UTC. Dark Reading, its first report on the story. The Gentlemen ransomware gang hits hundreds of global firms.
  • Mon 11 May, 10:27 UTC. Check Point. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Mon 11 May, 22:01 UTC. DataBreaches, its first report on the story. Gentlemen Ransomware Group leaks internal chats after breach.
  • Wed 13 May, 13:31 UTC. Check Point. Gentlemen RaaS leak reveals 332 victims, internal chats exposed. Cites a CVE in CISA KEV.
  • Wed 13 May, 21:41 UTC. Dark Reading. The Gentlemen ransomware gang breached, internal data up for sale.
  • Fri 15 May, 12:09 UTC. SOCRadar. Gentlemen Ransomware Group Suffers Leak After Internal Breach.
  • Thu 28 May, 17:10 UTC. Microsoft, its first report on the story. Gentlemen ransomware uses PsExec to encrypt and leak data.
  • Wed 3 Jun, 08:31 UTC. SecurityOnline. The Massive Gentlemen Ransomware Threat Sweeping Global Networks.
  • Wed 10 Jun, 14:21 UTC. Krebs on Security, its first report on the story. Ransomware gang The Gentlemen surges to second most active.
  • Wed 10 Jun, 15:27 UTC. DataBreaches. Krebs tracks clues to Gentlemen ransomware gang's elusive leader.
  • Thu 11 Jun, 17:27 UTC. The Hacker News. Gentlemen ransomware spreads like a worm, infecting 478 victims.
  • Mon 15 Jun, 07:30 UTC. Security Affairs, its first report on the story. Gentlemen ransomware gang spreads fast with AI and stolen creds.
  • Mon 15 Jun, 15:26 UTC. SecurityWeek, its first report on the story. Mackay Sugar Suffers Gentlemen Ransomware Attack, Mills Halted.
  • Mon 15 Jun, 19:50 UTC. Security Affairs. Mackay Sugar Hit by Ransomware as Crushing Season Stalls.
  • Fri 19 Jun, 19:00 UTC. The Hacker News. The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes.
  • Sat 20 Jun, 16:20 UTC. Security Affairs. The Gentlemen ransomware gang deploys eight variant EDR killer.
  • Mon 22 Jun, 15:10 UTC. Infosecurity. Gentlemen ransomware uses GentleKiller to disable security tools. This article, 26th of 44.
  • Mon 29 Jun, 10:30 UTC. Securelist, its first report on the story. The Gentlemen ransomware gang targets global firms with stealth.
  • Thu 2 Jul, 08:41 UTC. SecurityOnline. Gentlemen ransomware gang compromises 320 firms amid 2026 spike.
  • Fri 10 Jul, 22:10 UTC. Unit 42, its first report on the story. Gentlemen Ransomware Gang Hits 580 Victims, Targets Manufacturing.
  • Fri 17 Jul, 09:21 UTC. Infosecurity. Gentlemen Ransomware Surpasses Qilin After 300 Reported Attacks.
  • Fri 24 Jul, 09:25 UTC. Infosecurity. Ransomware Attacks Targeting Universities on the Rise.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Thu 13 Aug, 13:21 UTC. Check Point. Check Point Finds More Ransomware Groups Using AI Today.
  • Fri 4 Sep, 13:22 UTC. SecurityOnline. Gentlemen Ransomware Storms Networks Through Fortinet VPNs. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 13:01 UTC. SecurityWeek. Ransomware Attacks on Manufacturers Surge 40% as New Groups Emerge.
  • Thu 17 Sep, 14:48 UTC. Check Point. AI Models Escaped Testing to Breach Systems and Aid Extortion.
  • Mon 5 Oct, 13:18 UTC. DataBreaches. Ransomware Gang Threatens to Leak Data from South African Insurers.
  • Tue 6 Oct, 08:58 UTC. Infosecurity. RaaS Insider Stole Ransom Payments From More Than 25 Victims.
  • Tue 20 Oct, 11:56 UTC. SOCRadar. AI-Driven Ransomware Campaign Targeted 62 Organisations. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 23 Oct, 08:35 UTC. SecurityOnline. INC Ransomware Exposed Using AI and Custom Malware Against Victims. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 11:00 UTC. Securelist. Kaspersky details ransomware attacks on ESXi and Proxmox hosts.

A recent analysis from ESET revealed that the ransomware group Gentlemen has developed a sophisticated toolkit named GentleKiller, which can disable victims' endpoint security software before executing encryption. This toolkit targets over 400 security processes across 48 products, leveraging a technique known as Bring Your Own Vulnerable Driver (BYOVD) to exploit signed kernel drivers and enhance their stealth capabilities.

Unlike other ransomware operations, Gentlemen maintains and updates this toolkit themselves, offering various EDR killers including GentleKiller and others adapted from previous ransomware. Founded in late 2025 and operating on a unique model, Gentlemen typically targets victims in Southeast Asia, South America, and Western Europe, and provides affiliates with a significant share of profits.

How the story developed

All 44 articles
Developinglatest 8 hours ago44 articles14 outlets

44 articles from 14 outlets since 11 Sep. Picked up again today after 2 weeks quiet. This was the 26th report, 285 days after the first.

Now11 Sep31252114427262115528251992First reportSecurityOnline · 11 Sep, 00:40This article26th of 44 · day 284Exploited CVECheck Point · 13 May
  • Thu 11 Sep, 00:40 UTC. SecurityOnline, first report. The Gentlemen: A New Ransomware Group Using Legitimate Tools to Bypass Security.
  • Wed 29 Oct, 12:55 UTC. GBHackers, its first report on the story. New ‘Gentlemen’ RaaS Appears on Hacking Forums, Targeting Windows, Linux and ESXi.
  • Thu 20 Nov, 02:01 UTC. SecurityOnline. Sophisticated “The Gentlemen” Ransomware RaaS Emerges with XChaCha20 Encryption and 48 Victims in 3 Months.
  • Wed 17 Dec, 01:41 UTC. SecurityOnline. Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics.
  • Thu 12 Feb, 14:40 UTC. SOCRadar, its first report on the story. Dark Web Profile: The Gentlemen Ransomware.
  • Thu 19 Mar, 16:05 UTC. Infosecurity, its first report on the story. Ransomware Affiliate Exposes Details of 'The Gentlemen' Operation.
  • Mon 20 Apr, 13:21 UTC. Check Point, its first report on the story. Gentlemen RaaS adds ESXi locker, infects 320+ victims worldwide.
  • Tue 21 Apr, 14:21 UTC. Infosecurity. The Gentlemen ransomware hits 320 victims amid affiliate boom.
  • Tue 21 Apr, 20:01 UTC. The Hacker News, its first report on the story. Check Point links Gentlemen to SystemBC botnet of 1.5k victims.
  • Wed 22 Apr, 21:51 UTC. Dark Reading, its first report on the story. The Gentlemen ransomware gang hits hundreds of global firms.
  • Mon 11 May, 10:27 UTC. Check Point. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Mon 11 May, 22:01 UTC. DataBreaches, its first report on the story. Gentlemen Ransomware Group leaks internal chats after breach.
  • Wed 13 May, 13:31 UTC. Check Point. Gentlemen RaaS leak reveals 332 victims, internal chats exposed. Cites a CVE in CISA KEV.
  • Wed 13 May, 21:41 UTC. Dark Reading. The Gentlemen ransomware gang breached, internal data up for sale.
  • Fri 15 May, 12:09 UTC. SOCRadar. Gentlemen Ransomware Group Suffers Leak After Internal Breach.
  • Thu 28 May, 17:10 UTC. Microsoft, its first report on the story. Gentlemen ransomware uses PsExec to encrypt and leak data.
  • Wed 3 Jun, 08:31 UTC. SecurityOnline. The Massive Gentlemen Ransomware Threat Sweeping Global Networks.
  • Wed 10 Jun, 14:21 UTC. Krebs on Security, its first report on the story. Ransomware gang The Gentlemen surges to second most active.
  • Wed 10 Jun, 15:27 UTC. DataBreaches. Krebs tracks clues to Gentlemen ransomware gang's elusive leader.
  • Thu 11 Jun, 17:27 UTC. The Hacker News. Gentlemen ransomware spreads like a worm, infecting 478 victims.
  • Mon 15 Jun, 07:30 UTC. Security Affairs, its first report on the story. Gentlemen ransomware gang spreads fast with AI and stolen creds.
  • Mon 15 Jun, 15:26 UTC. SecurityWeek, its first report on the story. Mackay Sugar Suffers Gentlemen Ransomware Attack, Mills Halted.
  • Mon 15 Jun, 19:50 UTC. Security Affairs. Mackay Sugar Hit by Ransomware as Crushing Season Stalls.
  • Fri 19 Jun, 19:00 UTC. The Hacker News. The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes.
  • Sat 20 Jun, 16:20 UTC. Security Affairs. The Gentlemen ransomware gang deploys eight variant EDR killer.
  • Mon 22 Jun, 15:10 UTC. Infosecurity. Gentlemen ransomware uses GentleKiller to disable security tools. This article, 26th of 44.
  • Mon 29 Jun, 10:30 UTC. Securelist, its first report on the story. The Gentlemen ransomware gang targets global firms with stealth.
  • Thu 2 Jul, 08:41 UTC. SecurityOnline. Gentlemen ransomware gang compromises 320 firms amid 2026 spike.
  • Fri 10 Jul, 22:10 UTC. Unit 42, its first report on the story. Gentlemen Ransomware Gang Hits 580 Victims, Targets Manufacturing.
  • Fri 17 Jul, 09:21 UTC. Infosecurity. Gentlemen Ransomware Surpasses Qilin After 300 Reported Attacks.
  • Fri 24 Jul, 09:25 UTC. Infosecurity. Ransomware Attacks Targeting Universities on the Rise.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Thu 13 Aug, 13:21 UTC. Check Point. Check Point Finds More Ransomware Groups Using AI Today.
  • Fri 4 Sep, 13:22 UTC. SecurityOnline. Gentlemen Ransomware Storms Networks Through Fortinet VPNs. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 13:01 UTC. SecurityWeek. Ransomware Attacks on Manufacturers Surge 40% as New Groups Emerge.
  • Thu 17 Sep, 14:48 UTC. Check Point. AI Models Escaped Testing to Breach Systems and Aid Extortion.
  • Mon 5 Oct, 13:18 UTC. DataBreaches. Ransomware Gang Threatens to Leak Data from South African Insurers.
  • Tue 6 Oct, 08:58 UTC. Infosecurity. RaaS Insider Stole Ransom Payments From More Than 25 Victims.
  • Tue 20 Oct, 11:56 UTC. SOCRadar. AI-Driven Ransomware Campaign Targeted 62 Organisations. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 23 Oct, 08:35 UTC. SecurityOnline. INC Ransomware Exposed Using AI and Custom Malware Against Victims. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 11:00 UTC. Securelist. Kaspersky details ransomware attacks on ESXi and Proxmox hosts.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 44 articles as a list
  1. Thu 11 SepDay 01
    1. The Gentlemen: A New Ransomware Group Using Legitimate Tools to Bypass Security00:40 · SecurityOnline · First report

  2. Quiet for 7 weeks

    Wed 29 OctDay 481
    1. New ‘Gentlemen’ RaaS Appears on Hacking Forums, Targeting Windows, Linux and ESXi12:55 · GBHackers · Picked up again

  3. Quiet for 3 weeks

    Thu 20 NovDay 701
    1. Sophisticated “The Gentlemen” Ransomware RaaS Emerges with XChaCha20 Encryption and 48 Victims in 3 Months02:01 · SecurityOnline · Picked up again

  4. Quiet for 4 weeks

    Wed 17 DecDay 971
    1. Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics01:41 · SecurityOnline · Picked up again

  5. Quiet for 8 weeks

    Thu 12 FebDay 1541
    1. Dark Web Profile: The Gentlemen Ransomware14:40 · SOCRadar · Picked up again

  6. Quiet for 5 weeks

    Thu 19 MarDay 1891
    1. Ransomware Affiliate Exposes Details of 'The Gentlemen' Operation16:05 · Infosecurity · Picked up again

  7. Quiet for 5 weeks

    Mon 20 AprDay 2211
    1. Gentlemen RaaS adds ESXi locker, infects 320+ victims worldwide13:21 · Check Point · Picked up again
  8. Tue 21 AprDay 2222
    1. The Gentlemen ransomware hits 320 victims amid affiliate boom14:21 · Infosecurity
    2. Check Point links Gentlemen to SystemBC botnet of 1.5k victims20:01 · The Hacker News
  9. Wed 22 AprDay 2231
    1. The Gentlemen ransomware gang hits hundreds of global firms21:51 · Dark Reading

  10. Quiet for 3 weeks

    Mon 11 MayDay 2422
    1. Qilin Tops Ransomware List as Gentlemen Surge in Q1 202610:27 · Check Point · Picked up again
    2. Gentlemen Ransomware Group leaks internal chats after breach22:01 · DataBreaches

  11. Quiet for 2 days

    Wed 13 MayDay 2442
    1. Gentlemen RaaS leak reveals 332 victims, internal chats exposed13:31 · Check Point · Exploited CVE · Known exploited CVE
    2. The Gentlemen ransomware gang breached, internal data up for sale21:41 · Dark Reading

  12. Quiet for 2 days

    Fri 15 MayDay 2461
    1. Gentlemen Ransomware Group Suffers Leak After Internal Breach12:09 · SOCRadar

  13. Quiet for 13 days

    Thu 28 MayDay 2591
    1. Gentlemen ransomware uses PsExec to encrypt and leak data17:10 · Microsoft · Picked up again

  14. Quiet for 6 days

    Wed 3 JunDay 2651
    1. The Massive Gentlemen Ransomware Threat Sweeping Global Networks08:31 · SecurityOnline · Picked up again

  15. Quiet for 7 days

    Wed 10 JunDay 2722
    1. Ransomware gang The Gentlemen surges to second most active14:21 · Krebs on Security · Picked up again
    2. Krebs tracks clues to Gentlemen ransomware gang's elusive leader15:27 · DataBreaches
  16. Thu 11 JunDay 2731
    1. Gentlemen ransomware spreads like a worm, infecting 478 victims17:27 · The Hacker News

  17. Quiet for 4 days

    Mon 15 JunDay 2773
    1. Gentlemen ransomware gang spreads fast with AI and stolen creds07:30 · Security Affairs · Picked up again
    2. Mackay Sugar Suffers Gentlemen Ransomware Attack, Mills Halted15:26 · SecurityWeek
    3. Mackay Sugar Hit by Ransomware as Crushing Season Stalls19:50 · Security Affairs

  18. Quiet for 4 days

    Fri 19 JunDay 2811
    1. The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes19:00 · The Hacker News · Picked up again
  19. Sat 20 JunDay 2821
    1. The Gentlemen ransomware gang deploys eight variant EDR killer16:20 · Security Affairs

  20. Quiet for 2 days

    Mon 22 JunDay 2841
    1. Gentlemen ransomware uses GentleKiller to disable security tools15:10 · Infosecurity · This article, 26th of 44

  21. Quiet for 7 days

    Mon 29 JunDay 2911
    1. The Gentlemen ransomware gang targets global firms with stealth10:30 · Securelist · Picked up again

  22. Quiet for 3 days

    Thu 2 JulDay 2941
    1. Gentlemen ransomware gang compromises 320 firms amid 2026 spike08:41 · SecurityOnline · Picked up again

  23. Quiet for 9 days

    Fri 10 JulDay 3021
    1. Gentlemen Ransomware Gang Hits 580 Victims, Targets Manufacturing22:10 · Unit 42 · Picked up again

  24. Quiet for 6 days

    Fri 17 JulDay 3091
    1. Gentlemen Ransomware Surpasses Qilin After 300 Reported Attacks09:21 · Infosecurity · Picked up again

  25. Quiet for 7 days

    Fri 24 JulDay 3161
    1. Ransomware Attacks Targeting Universities on the Rise09:25 · Infosecurity · Picked up again

  26. Quiet for 7 days

    Fri 31 JulDay 3231
    1. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 202617:20 · DataBreaches · Picked up again

  27. Quiet for 7 days

    Fri 7 AugDay 3301
    1. Ransomware Surges in July After Q2 Lull08:31 · Infosecurity · Picked up again

  28. Quiet for 6 days

    Thu 13 AugDay 3361
    1. Check Point Finds More Ransomware Groups Using AI Today13:21 · Check Point · Picked up again

  29. Quiet for 3 weeks

    Fri 4 SepDay 3581
    1. Gentlemen Ransomware Storms Networks Through Fortinet VPNs13:22 · SecurityOnline · Picked up again · Known exploited CVE

  30. Quiet for 13 days

    Thu 17 SepDay 3712
    1. Ransomware Attacks on Manufacturers Surge 40% as New Groups Emerge13:01 · SecurityWeek · Picked up again
    2. AI Models Escaped Testing to Breach Systems and Aid Extortion14:48 · Check Point

  31. Quiet for 3 weeks

    Mon 5 OctDay 3891
    1. Ransomware Gang Threatens to Leak Data from South African Insurers13:18 · DataBreaches · Picked up again
  32. Tue 6 OctDay 3901
    1. RaaS Insider Stole Ransom Payments From More Than 25 Victims08:58 · Infosecurity

  33. Quiet for 2 weeks

    Tue 20 OctDay 4041
    1. AI-Driven Ransomware Campaign Targeted 62 Organisations11:56 · SOCRadar · Picked up again · Known exploited CVE
  34. Wed 21 OctDay 4051
    1. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption12:22 · Infosecurity

  35. Quiet for 2 days

    Fri 23 OctDay 4072
    1. INC Ransomware Exposed Using AI and Custom Malware Against Victims08:35 · SecurityOnline · Known exploited CVE
    2. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices18:36 · The Hacker News · Known exploited CVE

  36. Quiet for 2 weeks

    Fri 6 NovDay 4211
    1. Kaspersky details ransomware attacks on ESXi and Proxmox hosts11:00 · Securelist · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in