Threat reportMalwareTL-2026-0893
GentleKiller BYOVD EDR-Killing Framework Operated by The Gentlemen RaaS (hastalamuerte / Qilin lineage)
GentleKiller BYOVD EDR-Killing Framework Operated by The (TL-2026-0893), also tracked as GentleKiller, is a high-severity malware campaign, first published 2026-06-21. It is attributed to The Gentlemen (Russia) with medium confidence, affects Microsoft Defender / Windows endpoint security, references 2 CVEs (CVE-2022-42045, CVE-2025-26125), maps to 16 MITRE ATT&CK techniques (T1014, T1027, T1036), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 1The Gentlemen
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-0893
- Threat ID
- TL-2026-0893
- Also known as
- GentleKiller, Gentlemen EDR Killer Framework
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- multiple, corporate enterprises, managed service providers
- Target regions
- Southeast Asia, South America, Western Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in GentleKiller BYOVD EDR-Killing Framework Operated by The
Malware and tooling: GentleKiller, OxideHarvest, SystemBC - S9001, HavocKiller, HexKiller, ThrottleBlood
How GentleKiller BYOVD EDR-Killing Framework Operated by The works
GentleKiller is a centralized EDR-killing framework given to affiliates of The Gentlemen ransomware-as-a-service operation. Using Bring Your Own Vulnerable Driver (BYOVD), it loads legitimately signed but exploitable kernel drivers to terminate more than 400 security processes mapped to 48 products in a two-second scan-and-kill loop before ransomware deployment.
GentleKiller is a purpose-built endpoint-detection-and-response (EDR) killing suite developed and centrally maintained by The Gentlemen, a ransomware-as-a-service (RaaS) operation that emerged in 2025 and ranked among the most active ransomware gangs since the beginning of 2026 (ESET research, June 2026). Rather than delegating defense evasion to affiliates as most gangs do, The Gentlemen distributes a ready-to-use, standardized EDR-killer suite — materially lowering the entry barrier for affiliates and centralizing kernel-level tampering.
The framework is built around the Bring Your Own Vulnerable Driver (BYOVD) technique. Because Windows validates a driver's signature rather than the safety of its code, GentleKiller drops and loads legitimately signed but exploitable kernel-mode drivers, obtaining Ring 0 (kernel) privileges from which it issues DeviceIoControl requests to terminate protected security processes that user-mode malware cannot touch. Once a driver is loaded, GentleKiller runs a loop that periodically scans the running process list and terminates targeted processes every two seconds, defeating watchdog/respawn behavior of EDR agents. ESET reports the suite targets more than 400 processes mapped to 48 security products, including Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Palo Alto Networks (Cortex), ESET, Bitdefender, Kaspersky, Trend Micro, VMware Carbon Black, Elastic, and McAfee/Trellix.
GentleKiller exists in at least eight variants, each impersonating a legitimate product and abusing a different vulnerable or malicious driver: a Kaspersky-themed variant abusing the eb.sys rootkit; a FACEIT Anti-Cheat variant abusing nseckrnl.sys (NSecsoft); a Valorant variant abusing GameDriverX64.sys; a Javelin variant abusing Safetica's stpm_old.sys / stpm_new.sys; a WatchDog/Bitdefender-themed variant abusing Zemana's dmx.sys (CVE-2022-42045); a Network Blocker variant abusing Qihoo 360's 360netmon_wfp.sys; a Cleaner variant (Deletor.exe) abusing IObit's IMFForceDelete (CVE-2025-26125) to delete EDR files; and a G11/Symantec variant abusing the PoisonX rootkit. Variants are distributed under naming-convention suffixes that denote packing and signature state: suffix '1' uses Enigma protection with a fake signature and version info, suffix '2' uses Themida protection with a fake signature, 'Light' has no binary protection but a fake signature, and 'Clear' has neither protection nor a fake signature.
Beyond its in-house variants, The Gentlemen integrates at least three external EDR killers: HexKiller (Avast-themed; abuses googleApiUtil64.sys, the Baidu Antivirus BdApi driver; previously attributed to the Warlock gang), ThrottleBlood (Sent-themed; abuses ThrottleBlood.sys, a TechPowerUp driver; observed in MedusaLocker and DragonForce intrusions), and HavocKiller / HwAudKiller (Sophos-themed; abuses havoc.sys, a Huawei Audio driver; operational since January 23, 2026 and publicly disclosed March 19, 2026). The operation also fields OxideHarvest (aka buildx641), a Rust-written credential stealer maintained by affiliate 'quant' that harvests credentials from 19 Chromium-based and 8 Gecko-based browsers, and uses the SystemBC proxy botnet (1,570+ hosts believed to be corporate victims) for C2 and pivoting.
The Gentlemen was founded by 'hastalamuerte' — identified by reporting as Alexander Andreevich Yapaev, a 36-year-old Russian national from Izhevsk and a former Qilin affiliate — and offers affiliates an unusually high 90% revenue share. Victimology skews away from the United States, concentrating on Southeast Asia, South America, and Western Europe (including unusual targets such as Thailand, Brazil, and France); victim selection is driven primarily by exposed/misconfigured FortiGate appliances rather than geography. Per Ransomware.live the group has claimed roughly 504 victims. This record is defensive threat intelligence to drive detection of BYOVD driver loads, EDR-tampering process terminations, and the named tooling.
MITRE ATT&CK techniques used in TL-2026-0893
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.001 Invalid Code Signature; T1070.004 File Deletion
Execution
T1059.003 Windows Command Shell; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1543.003 Windows Service
Command and Control
Impact
T1486 Data Encrypted for Impact
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in GentleKiller BYOVD EDR-Killing Framework Operated by The
- Microsoft — Defender / Windows endpoint security
Vulnerable versions: targeted process termination via BYOVD - CrowdStrike — Falcon
Vulnerable versions: targeted process termination - SentinelOne — Singularity
Vulnerable versions: targeted process termination - Zemana — WatchDog (dmx.sys)
Vulnerable versions: CVE-2022-42045 - IObit — Malware Fighter (IMFForceDelete)
Vulnerable versions: CVE-2025-26125
Remediation for GentleKiller BYOVD EDR-Killing Framework Operated by The
Patches
- Apply vendor fixes/removals for vulnerable drivers (Zemana CVE-2022-42045; IObit CVE-2025-26125)
- Keep the Microsoft recommended driver blocklist updated
Immediate actions
- Enable and enforce Microsoft Vulnerable Driver Blocklist (HVCI) and WDAC to block known BYOVD drivers (eb.sys, nseckrnl.sys, GameDriverX64.sys, stpm_old.sys, stpm_new.sys, dmx.sys, 360netmon_wfp.sys, IMFForceDelete, googleApiUtil64.sys, ThrottleBlood.sys, havoc.sys, PoisonX)
- Hunt for new kernel-service creation and unsigned-to-signed driver loads (Sysmon EID 6, Windows EID 7045) immediately preceding mass EDR process termination
- Alert on EDR/AV agent processes terminating unexpectedly or in rapid succession (tamper-protection self-defense events)
Workarounds
- Block driver loads from user-writable paths via WDAC
- Restrict SeLoadDriverPrivilege and require admin approval for new kernel services
Longer-term hardening
- Deploy EDR with kernel-level tamper protection and a self-protecting/respawn watchdog that survives a 2-second kill loop
- Enable Hypervisor-Protected Code Integrity (HVCI / memory integrity) on all endpoints to block unsigned and known-vulnerable drivers
- Patch/replace Internet-exposed FortiGate appliances and enforce MFA on VPN to remove the gang's primary initial-access vector
- Centralize and forward security telemetry off-host so EDR kills do not blind the SOC
CVEs associated with GentleKiller BYOVD EDR-Killing Framework Operated by The
Weaknesses (CWE) in GentleKiller BYOVD EDR-Killing Framework Operated by The
Timeline of GentleKiller BYOVD EDR-Killing Framework Operated by The
- The Gentlemen RaaS emerged in 2025, founded by 'hastalamuerte', a former Qilin affiliate, offering affiliates a 90% revenue share.
- Since the beginning of 2026 The Gentlemen ranked among the most active ransomware gangs (ESET research).
- HavocKiller (havoc.sys, Huawei Audio driver) observed operational within the Gentlemen EDR-killer arsenal.
- HavocKiller publicly disclosed by external researchers.
- An internal data leak of the gang's operations occurred, exposing tooling and affiliate details.
- Reporting attributed 'hastalamuerte' to Alexander Andreevich Yapaev, a 36-year-old Russian national from Izhevsk.
- ESET published 'Killing me gently', the deep-dive analysis of GentleKiller and the Gentlemen EDR-killer framework.
- Follow-on reporting documented ~504 claimed victims and the eight-variant BYOVD framework targeting 400+ processes across 48 security products.
Sources cited for GentleKiller BYOVD EDR-Killing Framework Operated by The
- Killing me gently: Inside Gentlemen's EDR killer framework
- The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
- Gentlemen ransomware uses multiple EDR killers to disable defenses
- Inside GentleKiller: The EDR-Killer Powering The Gentlemen
- GentleKiller Ransomware Abuses Vulnerable Drivers to Disable 400+ EDR Security Processes
- Threat actor adds advanced 'EDR killer' tools to ransomware-as-a-service platform
Detection coverage for TL-2026-0893
As of 2026-06-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0893 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.