Ransomware groups adopt EDR-killer tools to boost attacks

A sophisticated ransomware operation known as The Gentlemen has rapidly ascended to become one of the most active cybercriminal groups by providing its affiliates with a powerful, standardized suite of tools designed to disable enterprise security software. This centralization of endpoint detection and response (EDR) "killer" tools lowers the technical barrier for affiliates and has contributed to the group's claim of 504 victims since its emergence in late 2025, making it one of the top five most active ransomware operations in the first quarter of 2026.

The core of this capability is an in-house framework dubbed "GentleKiller," according to a detailed technical analysis published by cybersecurity firm ESET on June 18. The report, which corroborated months of investigation with an internal data leak from The Gentlemen in May 2026, reveals the group's operational model. Unlike most ransomware-as-a-service gangs that leave affiliates to source their own EDR evasion tools, The Gentlemen's operators develop and maintain a portfolio of these tools for their affiliates' use.

GentleKiller consists of at least eight distinct variants, each impersonating a different legitimate software...