Actor Profile

Gentlemen is a ransomware-as-a-service (RaaS) operation that provides infrastructure, tools, and support to affiliate threat actors who conduct ransomware attacks. The operation distinguishes itself through active development and maintenance of multiple EDR (Endpoint Detection and Response) killer utilities, which are provided to affiliates to disable security defenses during intrusion operations. The RaaS model allows the operators to scale attacks through a network of affiliates while maintaining centralized tooling and infrastructure.

TTPs (Tactics, Techniques, Procedures)

The primary observed TTP involves defense evasion through the use of EDR killer tools designed to disable or impair endpoint security products (T1562.001 - Impair Defenses: Disable or Modify Tools). These utilities target EDR solutions to blind security monitoring and prevent detection during ransomware deployment. The active development of multiple EDR killer variants suggests ongoing efforts to evade specific security products and adapt to defensive countermeasures. The RaaS model itself facilitates initial access and execution through affiliate networks, though specific initial access vectors are not detailed in available reporting.

Targets & Patterns

Specific targeted sectors and geographic focus are not identified in available reporting. The RaaS model suggests opportunistic targeting driven by affiliate capabilities and access rather than centralized victim selection. Organizations with EDR solutions are explicitly targeted, as the development of EDR killer tools indicates focus on environments with mature security controls. The provision of defense evasion tools to affiliates suggests targeting of organizations where endpoint security represents a significant barrier to ransomware deployment.

Historical Context

The development of EDR killer tools represents an evolution in ransomware operations, reflecting the increasing deployment of endpoint security solutions across enterprise environments. This approach mirrors tactics used by other RaaS operations and cybercrime groups that have developed or adopted tools like BYOVD (Bring Your Own Vulnerable Driver) exploits to disable security software. The active maintenance of multiple EDR killer tools suggests Gentlemen is responding to the same defensive pressures that have driven similar tool development in operations like BlackCat/ALPHV, LockBit, and other established RaaS platforms.

Defensive Recommendations

  • Monitor for suspicious driver loading activity and unsigned/vulnerable driver exploitation attempts (T1068, T1014) commonly used in EDR killer tools via Sysmon Event ID 6 and Windows Security Event 4697
  • Implement application control policies and driver signature enforcement to prevent execution of known EDR killer utilities and vulnerable driver abuse
  • Enable tamper protection features in EDR solutions and monitor for service/process termination attempts targeting security tools via Event IDs 7034, 7036, and 7040
  • Deploy behavioral detection rules for processes attempting to interact with security service processes, registry keys, or drivers associated with EDR products
  • Maintain offline or immutable backups with regular testing to ensure recovery capability if ransomware deployment succeeds despite preventive controls