The Industrialization of EDR Evasion: How Gentlemen RaaS Transformed Cybercrime
The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly scaled to become a top-five ransomware gang by Q1 2026, fundamentally transforming EDR evasion from individual hacker tricks into an industrialized service economy. The group developed GentleKiller, a comprehensive EDR killer framework featuring eight variants that abuse vulnerable drivers from NSecsoft, Zemana, Qihoo 360, and Safetica to terminate over 400 security processes across 48 different security products. Their business model offers affiliates a generous 90% revenue share while centralizing the most technically complex evasion capabilities, effectively democratizing kernel-level EDR bypass techniques to low-skill operators. This incident represents a critical inflection point in the ransomware ecosystem where sophisticated evasion capabilities are now productized, maintained, and distributed at scale, creating persistent threats that survive individual takedowns and continuously evolve through centralized development.
Kill Chain
