Executive Summary
The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly scaled to become a top-five ransomware gang by Q1 2026, fundamentally transforming EDR evasion from individual hacker tricks into an industrialized service economy. The group developed GentleKiller, a comprehensive EDR killer framework featuring eight variants that abuse vulnerable drivers from NSecsoft, Zemana, Qihoo 360, and Safetica to terminate over 400 security processes across 48 different security products. Their business model offers affiliates a generous 90% revenue share while centralizing the most technically complex evasion capabilities, effectively democratizing kernel-level EDR bypass techniques to low-skill operators.
This incident represents a critical inflection point in the ransomware ecosystem where sophisticated evasion capabilities are now productized, maintained, and distributed at scale, creating persistent threats that survive individual takedowns and continuously evolve through centralized development.
Why This Matters Now
The commercialization of EDR evasion through frameworks like GentleKiller signals a fundamental shift where kernel-level security bypasses are becoming commoditized services rather than rare technical skills, dramatically lowering the barrier to entry for ransomware operations.
Attack Path Analysis
Ransomware-as-a-Service operators leveraged BYOVD techniques to deploy EDR killers through legitimate-appearing drivers, escalated privileges via kernel access, moved laterally across enterprise networks while evading detection, maintained command and control through encrypted channels, exfiltrated sensitive data before encryption, and deployed ransomware payloads while disabling security controls across the entire infrastructure.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers gained initial access through phishing or exploit kits, deploying vulnerable signed drivers disguised as legitimate security products to bypass application whitelisting and establish foothold
Related CVEs
CVE-2018-5537
CVSS 5.3A vulnerability in NSecsoft driver allows local privilege escalation through kernel mode access, commonly exploited by BYOVD attacks to terminate security processes.
Affected Products:
NSecsoft NSecsoft Driver – < 1.0.2
Exploit Status:
exploited in the wildCVE-2020-17382
CVSS 7.8Zemana driver contains a vulnerability that allows local attackers to execute arbitrary code in kernel mode, frequently abused by ransomware groups for EDR evasion.
Affected Products:
Zemana Zemana Anti-Malware – < 4.2.28
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploitation for Privilege Escalation
Impair Defenses: Disable or Modify Tools
Rootkit
Masquerading: Match Legitimate Name or Location
OS Credential Dumping
Data Encrypted for Impact
Process Injection
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Deploy intrusion-detection and/or intrusion-prevention techniques
Control ID: 11.5.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – ICT risk management framework
Control ID: Article 11
CISA ZTMM 2.0 – Enterprise assets are inventoried and risks are assessed
Control ID: ED.AM.3
NIS2 Directive – Cybersecurity risk management measures
Control ID: Article 21(2)(a)
ISO 27001:2022 – Management of technical vulnerabilities
Control ID: A.8.7
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical exposure to ransomware-as-a-service EDR killers targeting protected processes, compromising PCI compliance and enabling lateral movement across trading systems.
Health Care / Life Sciences
Vulnerable to kernel-level attacks disabling endpoint protection, violating HIPAA requirements while enabling data exfiltration from patient record systems.
Computer Software/Engineering
Prime targets for bring-your-own-vulnerable-driver attacks exploiting software development environments, source code repositories, and cloud-native security fabric vulnerabilities.
Government Administration
High-value targets for sophisticated EDR killer frameworks enabling privilege escalation and east-west traffic compromise across classified network segments.
Sources
- Bring Your Own Vulnerable Device: The EDR Killer Economyhttps://www.sentinelone.com/blog/bring-your-own-vulnerable-device-the-edr-killer-economy/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- National Vulnerability Databasehttps://nvd.nist.gov/Verified
- FIN7 Reboot: Cybercrime Gang Enhances Ops with New EDR Bypasseshttps://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of BYOVD ransomware attacks by constraining lateral movement and controlling egress paths. While initial compromise may still occur, segmented network access would limit attacker reach across enterprise infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial foothold establishment would likely still occur, but attacker reachability beyond the initially compromised workload could be significantly constrained through network segmentation boundaries
Control: Zero Trust Segmentation
Mitigation: Kernel-level privilege escalation may still succeed on compromised hosts, but zero trust boundaries would likely constrain the scope of elevated access across network segments
Control: East-West Traffic Security
Mitigation: Lateral movement attempts would likely encounter significant restrictions as east-west traffic controls could block unauthorized communication paths between network segments and workloads
Control: Multicloud Visibility & Control
Mitigation: Command and control communications could be significantly constrained through enhanced visibility and traffic analysis capabilities that may detect anomalous communication patterns across cloud environments
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts would likely face significant constraints as egress controls could block unauthorized outbound data flows and restrict access to external communication channels
Ransomware deployment scope would likely be significantly reduced due to network segmentation boundaries, limiting encryption impact to isolated workload segments rather than enterprise-wide infrastructure
Impact at a Glance
Affected Business Functions
- Endpoint Detection and Response Systems
- Security Operations Centers
- Data Protection Services
- Incident Response Capabilities
Estimated downtime: 14 days
Estimated loss: $2,500,000
Compromise of enterprise security infrastructure enabling potential access to sensitive corporate data, intellectual property, and confidential business communications across affected organizations utilizing vulnerable EDR solutions
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with microsegmentation policies to limit lateral movement even when EDR capabilities are compromised
- • Deploy Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration attempts through anomalous outbound traffic patterns
- • Enable Multicloud Visibility & Control to maintain behavioral monitoring and anomaly detection capabilities independent of endpoint security solutions
- • Utilize Threat Detection & Anomaly Response with baseline behavioral analysis to identify process termination loops and suspicious driver loading activities
- • Strengthen East-West Traffic Security monitoring to detect lateral movement patterns and unauthorized service-to-service communications during security tool outages
