Actor Profile

Gentlemen is a ransomware-as-a-service (RaaS) operation that provides infrastructure, tooling, and support to affiliate threat actors. The group actively develops and distributes specialized frameworks to enhance affiliate success rates, including the GentleKiller EDR evasion tool. As a RaaS operator, Gentlemen follows the affiliate model common in cybercrime ecosystems, where core developers maintain the ransomware and supporting tools while affiliates conduct intrusions and deploy payloads in exchange for profit sharing. The group's investment in sophisticated EDR bypass capabilities demonstrates a focus on evading modern security controls to maximize operational effectiveness.

TTPs (Tactics, Techniques, Procedures)

The primary TTP associated with Gentlemen operations is defense evasion through the GentleKiller framework, which targets approximately 400 security processes to disable endpoint detection and response systems (T1562.001 - Impair Defenses: Disable or Modify Tools). This capability is deployed prior to ransomware execution to blind security monitoring and prevent automated response. The use of a dedicated EDR-killing tool indicates systematic preparation of victim environments (T1490 - Inhibit System Recovery may also apply if backup or recovery agents are targeted). The RaaS model itself facilitates initial access through diverse affiliate tactics, though specific intrusion vectors are not detailed in available reporting. Ransomware deployment represents the final impact stage (T1486 - Data Encrypted for Impact).

Targets & Patterns

No specific targeted sectors or geographic regions are identified in available reporting. As a ransomware-as-a-service operation, Gentlemen likely exhibits opportunistic targeting patterns driven by affiliate capabilities and access rather than strategic sector focus. The development of GentleKiller—a tool designed to evade approximately 400 security products—suggests the operation anticipates encounters with mature security environments across diverse victim organizations. RaaS operations typically target entities based on perceived ability to pay ransoms rather than sector-specific intelligence requirements, though affiliate specialization may introduce targeting patterns not yet publicly documented.

Historical Context

Gentlemen operates within the established ransomware-as-a-service ecosystem that has dominated the ransomware landscape since approximately 2019-2020, following the model pioneered by operations such as REvil, LockBit, and BlackCat/ALPHV. The development of specialized EDR evasion frameworks distributed to affiliates represents an evolution in RaaS sophistication, as earlier operations relied more heavily on commodity tools or expected affiliates to bring their own evasion capabilities. GentleKiller's targeting of approximately 400 security processes indicates continuous development and adaptation to the security product landscape, though the timeline of this tool's development and deployment to affiliates is not specified in available data.

Defensive Recommendations

  • Monitor for suspicious termination of security processes (T1562.001) via EDR telemetry and Windows Event Logs (Event ID 4689 process termination, Sysmon Event ID 5 process terminated); alert on multiple security service stops in rapid succession
  • Implement tamper protection features in EDR platforms and enable protected process light (PPL) for security agents to prevent unauthorized termination by user-mode tools
  • Deploy application control policies (AppLocker, Windows Defender Application Control) to restrict execution of unsigned or unknown binaries, particularly those attempting to interact with security processes
  • Establish behavioral detection rules for tools exhibiting process enumeration followed by targeted termination patterns, especially when targeting known security product process names
  • Maintain offline or immutable backups with separate authentication domains to ensure recovery capability even if EDR and backup agents are disabled during an intrusion