Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief June 22, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we're covering a ransomware operation that may signal the next evolution of ransomware as a service, not because of how it encrypts data, but because of how it disables security before encryption even begins. ESET researchers have published new findings on the Gentleman Ransomware Group and its sophisticated EDR killing framework known as Gentle Killer. Gentleman emerged in late 2025 and quickly became one of the most active ransomware operations observed during the first quarter of 2026. What makes the group different is its approach to defensive evasion. Most ransomware operators leave endpoint security bypass techniques to individual affiliates. Gentlemen does not. Instead, it provides professionally maintained EDR killing tools directly to affiliates as part of the service. That changes everything. GentleKiller is an internally developed framework with at least eight distinct variants. Each variant impersonates a legitimate application while abusing a different vulnerable kernel level driver. Collectively, the framework targets more than 400 security related processes associated with 48 security products. The victim list includes Microsoft Defender, CrowdStrike, Sentinel One, Sophos, Palo Alto Networks, ESET, BitDefender, Kaspersky, and many others. The technique behind the framework is known as bring your own vulnerable driver or BYOVD. Attackers deploy signed drivers containing malicious functionality. Once loaded, those drivers execute within the Windows kernel and gain Ring Zero privileges. That is the highest privilege level available within the operating system. And from that position, traditional endpoint protections lose much of their defensive advantage. Most EDR products operate primarily within user space. Gentle Killer operates beneath them. Once active, the framework continuously scans the system and terminates protected security processes every two seconds. If an EDR agent restarts, it is immediately killed again. Researchers identified variants abusing vulnerable drivers associated with Kaspersky, FaceIT, Anti-Cheat, Valorant, Javelin, Zamana Watchdog, Chihu 360, IOBit, and the Poison X rootkit. But the most concerning aspect may be the speed of adoption. Tools such as Unknown Killer and Poison Killer were reportedly incorporated into Gentleman operations within days of public disclosure. Most ransomware groups take weeks or months to operationalize new techniques. Gentleman appears capable of doing it almost immediately. That suggests a dedicated development pipeline and a well-funded operation. The group has also integrated additional EDR disabling frameworks, including HexKiller. Previously linked to warlock operations, throttle blood associated with Medusa Locker activity, and HavocKiller, which abuses Huawei audio drivers. All of these tools are wrapped in advanced obfuscation layers using Enigma and Thermida protection systems while impersonating legitimate software vendors through fabricated version information and stolen certificates. This is not opportunistic cybercrime. This is software engineering. Research has also uncovered evidence of a highly structured affiliate model. Gentleman reportedly offers affiliates a 90% revenue share, significantly higher than many competing ransomware programs. Victim selection is centralized and appears heavily focused on exposed 40 gate infrastructure, helping explain the group's activity across Southeast Asia, South America, and Western Europe. An internal data leak in May 2026 provided further insight. Leaked chat logs showed leadership actively maintaining. Updating and distributing EDR killing packages to approved affiliates. In other words, defensive evasion has become a managed service. So what should organizations do now? First, enforce Microsoft's vulnerable driver block list across all Windows systems. Second, enable hypervisor-protected code integrity wherever supported. Third, implement strict driver allow listing policies that permit only approved drivers to execute. Fourth, monitor for unusual driver installation activity combined with security process termination events. And finally, do not rely exclusively on endpoint protection. Network segmentation, immutable backups, threat hunting, and layered detection remain essential. The strategic lesson is simple. Ransomware operations are becoming increasingly professional. Gentlemen represents a shift from affiliate-driven attacks towards standardized offensive platforms. Where advanced capabilities are packaged, maintained, and distributed centrally. When defensive evasion becomes a service, attacks become more reliable, more scalable, and significantly harder to stop. Organizations that continue treating kernel-level driver abuse as a niche threat may be underestimating how quickly modern ransomware operations are evolving. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.