The Gentlemen Ransomware Disables Defender, Destroys Backups and Uses Driver-Based EDR Killer

Acronis researchers detailed how The Gentlemen, a Russian-speaking ransomware-as-a-service operation, undermines security controls and recovery before encrypting files. Its Go-based ransomware supports Windows, Linux, network-attached storage and BSD systems. The Windows variant attempts to disable Microsoft Defender, stop security and backup services, delete Volume Shadow Copies and erase forensic evidence. It can establish persistence and spread between workstations through PsExec when propagation is enabled. An accompanying endpoint detection and response (EDR) killer abuses vulnerable Safetica ProcessMonitorDriver and Lenovo BootRepair.sys kernel drivers to terminate security processes.

The operation emerged under its own brand in mid-2025 after reportedly working with LockBit and Qilin, combines data theft with encryption for double extortion, and offers affiliates up to 90% of ransom proceeds. It claims more than 800 victims, predominantly in the United States and Europe, but that total is not independently confirmed. A May 2026 breach of its infrastructure exposed communications, negotiations and affiliate information, providing further evidence of leadership links to the Qilin ecosystem. Defenders should monitor coordinated security-service shutdowns and backup deletion, restrict administrative privileges, segment networks, address vulnerable drivers and maintain tested offline or immutable backups.