The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
Before deploying the encryptor, the Gentlemen ransomware-as-a-service (RaaS) organization actively develops and maintains a suite of endpoint detection and response (EDR) killers that it distributes to affiliates in order to weaken system defenses.
The GentleKiller framework serves as the foundation for this well-developed collection of EDR-terminating solutions.
According to a report shared with The Hacker News by ESET security researcher Jakub Souček, they also use third-party or leaked tools like HexKiller, ThrottleBlood, and HavocKiller. "These tools are standardized through a shared defense-evasion layer, impersonating predominantly security vendors using fake version information, and copied legitimate certificates and icons," Souček said.
The ransomware team was also critic...