GentleKiller targets more than 400 security processes across 48 products (opens in new tab)

Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors. An internal data leak from the group in May 2026 confirmed the arrangement and exposed the gang’s leader discussing the supply ...