# The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts

> The Gentlemen, a ransomware-as-a-service operation founded by former Qilin affiliate hastalamuerte after a 2025 payment dispute, displaced Qilin as the #1 ransomware group in June 2026 with 121 claimed victims (vs. Qilin's 80), ending Qilin's 12-month reign. The group runs a 90% affiliate profit-share and equips affiliates with GentleKiller, an in-house BYOVD EDR-killer framework with at least eight driver variants that disables 400+ processes across 48 security vendors, alongside LLM-assisted infrastructure/code maintenance.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1332
- **ID:** TL-2026-1332
- **Severity:** HIGH (CVSS 9.6)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen (Russia)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, CVE-2025-32463, CVE-2024-37085, CVE-2025-26125

## Description

The Gentlemen (RaaS admin/founder alias 'hastalamuerte', identified by Krebs/PRODAFT as Russian national Alexander Andreevich Yapaev) emerged from the Qilin affiliate ecosystem in mid-2025. hastalamuerte previously ran a ~20-member Qilin-affiliated crew called ArmCorp and, after a public $48,000 payment-dispute arbitration against Qilin operators on the RAMP forum on 22 July 2025, spun up an independent RaaS brand. First Windows ransomware sample surfaced on VirusTotal 17 July 2025; the group's own leak site went live by early September 2025, alongside an official RaaS launch offering affiliates a 90% profit share (an unusually aggressive split versus the industry-standard 70-80%). PRODAFT has also linked Gentlemen operators to prior affiliate work with Qilin, Embargo, LockBit, Medusa, and BlackLock.

Initial access is edge-infrastructure-centric: mass exploitation of CVE-2024-55591 (FortiOS/FortiProxy authentication bypass via crafted Node.js WebSocket requests achieving super_admin), CVE-2025-32433 (unauthenticated Erlang/OTP SSH daemon RCE, CVSS 10.0), CVE-2025-33073 (Windows SMB Client), and CVE-2025-55182 (React2Shell), plus credential brute-forcing against ~1,000 additional FortiGate VPNs using an 80+ entry dictionary (including honeypot-detection garbage strings) and purchases from initial access brokers. The group maintains an internal database of ~14,700 internet-facing FortiGate devices, built via Shodan/ZoomEye reconnaissance and a cracked SoftPerfect Network Scanner.

Once inside, affiliates use NetExec for host discovery/brute force/lateral movement, DonPAPI and Impacket's dpapi.py for automated DPAPI/LSA secret extraction, a custom Python tool (userpassfort.py) to harvest Fortinet credentials, and custom PowerShell (VCENTER.ps1) to pivot into vSphere/ESXi environments. Persistence and lateral spread rely on new domain accounts (e.g. 'MicrosoftSupporte'), GPO manipulation (including privilege escalation via BadSuccessor, CVE-2025-32463, CVE-2024-37085), RDP group additions, SMB/admin-share access, and AnyDesk/MeshCentral remote-management deployment (hardcoded credentials in shared deployment scripts). Chisel is tunneled over 443 for reverse SOCKS C2, and SystemBC has been observed for auxiliary C2 traffic.

Defense evasion is anchored by GentleKiller, an in-house EDR-killer framework ESET assessed as an internal Gentlemen tool (later corroborated by Group-IB and Check Point) with at least eight distinct variants, each impersonating a legitimate security/gaming product (Kaspersky, FACEIT Anti-Cheat, Valorant, Javelin/EAAntiCheat, WatchDog, a network blocker branded as Qihoo 360, an IObit-branded 'Deletor' cleaner abusing CVE-2025-26125, and a 'G11'/Symantec-branded variant using a custom rootkit driver called PoisonX). Each variant drops and loads a distinct vulnerable or malicious kernel driver as a service (eb.sys, nseckrnl.sys, GameDriverX64.sys, stpm_old.sys/stpm_new.sys, dmx.sys, 360netmon_wfp.sys, IMFForceDelete, PoisonX) and issues DeviceIoControl/native-API IOCTLs from user mode to terminate 400+ processes mapped to 48 security vendors (Microsoft Defender, CrowdStrike, SentinelOne, Kaspersky, Bitdefender, Sophos, and more) at Ring 0, defeating user-mode tamper protection. Binaries are packed with Enigma/Themida, carry forged version info and vendor icons, and copy invalid digital signatures from legitimate executables. Affiliates additionally deploy third-party/leaked EDR killers HexKiller, ThrottleBlood (ThrottleBlood.sys), HavocKiller, viragt64.sys, and an 'EDR-Freeze' tool, plus AntSword webshells. Host-side, operators disable Windows Defender/EDR via PowerShell and GPO, modify registry keys to uninstall Bitdefender endpoint agents and redirect/disable WMI ReadyBoot and GlobalLogger event tracing, and clear Security/Application/System/RDP event logs.

Exfiltration is performed primarily via Rclone (renamed avastrclone.exe to blend in, scheduled through rclone.ps1) configured against an SFTP drop at 194.87.31[.]69:2222, with MEGA suggested as a fallback. Credential theft tooling includes a custom Chrome password stealer (ChromeKB3.exe) and Veeam credential extraction.

The ransomware itself is written in both C and Go, with Windows, Linux, and ESXi-specific variants (the ESXi locker, released 10 September 2025, kills non-whitelisted processes, deletes VM snapshots, and disables auto-start services) plus a 'GLOCKER' one-click builder for affiliate deployment. Encryptor execution requires an 8-byte password parameter (--password), supports a custom output path (--path), and — since 21 September 2025 — a delayed-execution timer (--T, in minutes) paired with WMI-based domain-wide spread. Impact operations kill 100+ processes (SQL Server, VMware, Veeam, Exchange, backup agents), delete Volume Shadow Copies via vssadmin/wmic, clear the Recycle Bin and Prefetch, replace the desktop wallpaper, drop a ransom note (README-GENTLEMEN.txt), append the .7mtzhh extension to encrypted files, and self-cleanup via batch script.

Operationally the group has scaled unusually fast: Halcyon assessed ~300 victims across 66 countries within roughly a year of independent operation; by April 2026 the group accounted for ~10% of global ransomware activity; by July 2026 cumulative claimed victims reached 580 across 77 countries (manufacturing the top vertical, 103 of 580), a 6x increase in claimed-victim volume comparing H2 2025 to H1 2026, and the group's June 2026 total of 121 claimed victims made it the #1-ranked RaaS operation, surpassing Qilin's 80 and ending Qilin's 12-month run at the top of Bitdefender's tracked leaderboard. Bitdefender additionally reports the group uses LLM assistant add-ons (screenshots confirm ChatGPT and Gemini use, with references to Claude via MCP for pentesting integration, and to Qwen/DeepSeek as less-restricted alternatives) to speed up infrastructure and code maintenance. Notable OpSec failures include hardcoded RAMP forum post text left in an encryptor binary (Cybereason), the group's own public arbitration dispute revealing its origin story, and a May 2026 insider/BreachForums-linked leak exposing Russian-speaking affiliate handles and admin details.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1590 Gather Victim Network Information
- T1587.001 Malware
- T1588.006 Vulnerabilities
- T1585.003 Cloud Accounts
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1110.001 Password Guessing
- T1003.004 LSA Secrets
- T1555.003 Credentials from Web Browsers
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1059.001 PowerShell
- T1059.006 Python
- T1106 Native API
- T1053 Scheduled Task/Job
- T1543.003 Windows Service
- T1098 Account Manipulation
- T1098.007 Additional Local or Domain Groups
- T1136.002 Domain Account
- T1484.001 Group Policy Modification
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1036 Masquerading
- T1036.001 Invalid Code Signature
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1685.005 Clear Windows Event Logs
- T1211 Exploitation for Stealth
- T1087.002 Domain Account
- T1615 Group Policy Discovery
- T1046 Network Service Discovery
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact

## Sources

- [Bitdefender Threat Debrief: July 2026](https://www.bitdefender.com/en-gb/blog/businessinsights/bitdefender-threat-debrief-july-2026)
- [Killing me gently: Inside Gentlemen's EDR killer framework](https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/)
- [The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes](https://thehackernews.com/2026/06/the-gentlemen-raas-uses-gentlekiller.html)
- [Gentlemen ransomware uses multiple EDR killers to disable defenses](https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/)
- [No Manners Here: The Ruthless Rise of The Gentlemen Ransomware](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/)
- [ESET Research investigates Gentlemen ransomware gang and its defense-evasion tools](https://www.eset.com/us/about/newsroom/research/eset-research-gentlemen-ransomware-gang-edr-killers/)
- [GentleKiller Ransomware Abuses Vulnerable Drivers to Disable 400+ EDR Security Processes](https://cybersecuritynews.com/gentlekiller-ransomware-edr-processes/)
- [How Hastalamuerte Operates: Group-IB's Analysis of The Gentlemen's Attack Methods](https://www.group-ib.com/blog/hastalamuerte-gentlemen-raas-ttps/)
- [A Closer Look at The Gentlemen's Alleged Leak](https://www.levelblue.com/blogs/spiderlabs-blog/a-closer-look-at-the-gentlemens-alleged-leak)
- [CVE-2024-55591 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2024-55591)
- [CVE-2025-32433: Critical Erlang/OTP SSH Vulnerability (CVSS 10)](https://www.upwind.io/feed/cve-2025-32433-critical-erlang-otp-ssh-vulnerability-cvss-10)
- [Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild](https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/)
- [GentleKiller Framework Disables Victims' Security Software](https://www.infosecurity-magazine.com/news/gentlekiller-gentlemen-ransomware/)
- [Inside GentleKiller: The EDR-Killer Powering The Gentlemen](https://securityaffairs.com/193941/malware/inside-gentlekiller-the-edr-killer-powering-the-gentlemen.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1332