Gentlemen RaaS deploys multi-tool EDR evasion suite

The Gentlemen ransomware-as-a-service (RaaS) operation has built a modular toolkit to disable endpoint detection and response (EDR) systems before launching encryption or data-theft attacks. Security researchers report that the group’s primary utility, dubbed GentleKiller, now exists in at least eight variants, each impersonating legitimate software and exploiting vulnerable drivers to gain kernel-level access on target machines.

How the toolkit works

GentleKiller variants share a common codebase and obfuscation methods but swap out the vulnerable driver used to escalate privileges. This design allows the group to quickly incorporate newly disclosed driver flaws without rewriting the core logic. Once elevated, the tool targets over 400 processes linked to approximately 48 security vendors, including Microsoft Defender, CrowdStrike Falcon, SentinelOne, Palo Alto Cortex, and ESET itself. The binaries are protected by commercial packers Enigma and Themida, and some samples carry invalid digital signatures stolen from legitimate applications.

In addition to GentleKiller, the Gentlemen RaaS toolkit includes at least three third-party EDR killers: HexKiller, ThrottleBlood, and HavocKiller. Researchers suggest these may provide redundancy, complicate attribution, or address scenarios where GentleKiller’s effectiveness is limited. A separate Rust-based credential-stealer, OxideHarvest, is also deployed, likely sourced externally given its programming language.

Target selection and recent activity

The group appears to prioritize organizations running FortiGate VPN endpoints, possibly leveraging credentials exposed in the FortiBleed leak of nearly 74,000 FortiGate VPN logins. While the timing of the leak is not specified in recent reports, the Gentlemen RaaS previously breached Romanian energy provider Oltenia. The operation has also been linked to a SystemBC proxy malware botnet comprising over 1,570 corporate hosts, which may serve as a command-and-control or data-exfiltration channel.

What to watch

The modular design of GentleKiller suggests the group will continue to weaponize newly disclosed driver vulnerabilities. Security vendors may also see increased use of stolen or forged digital signatures to bypass code-signing checks. Organizations running FortiGate appliances should rotate VPN credentials and review patch levels, particularly if credentials were exposed in the FortiBleed incident.