GentleKiller
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The most prevalent EDR killer in the group's ecosystem is GentleKiller, a self-developed tool with at least eight variants targeting more than 400 processes.
The core of the suite is GentleKiller, first observed in a staging directory called GentlemenCollection. It is the most common EDR killer in Gentlemen intrusions and appears in at least eight variants, each one impersonating a different legitimate product and abusing a different vulnerable or malicious kernel driver.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth
5 techniques
Stealth
they all share the same underlying characteristics, including terminating processes periodically and employing identical code obfuscation.
Many samples also receive commercial packing through Enigma or Themida, recorded in a filename suffix.
These tools are standardized through a shared defense-evasion layer, impersonating predominantly security vendors using fake version information... The overarching defense-evasion strategy includes ... spoofing trusted vendors' identities
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An in-house EDR-killer framework used by the Gentlemen ransomware operation to disable endpoint detection and response products. It has at least eight variants, impersonates legitimate security products, abuses vulnerable or malicious kernel drivers, and targets more than 400 process names associated with 48 security products.
A self-developed endpoint detection and response killing tool used in The Gentlemen ransomware ecosystem. It has at least eight variants, targets more than 400 processes, periodically terminates processes, uses identical code obfuscation across variants, impersonates legitimate products, and abuses different vulnerable or malicious drivers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.