Inside GentleKiller: The EDR-Killer Powering The Gentlemen

The Gentlemen ransomware group utilizes a sophisticated EDR-killer suite, known as GentleKiller, to disable security tools and gain unrestricted access to targeted systems. This centralized suite exploits Bring Your Own Vulnerable Driver (BYOVD) vulnerabilities, allowing affiliates to launch devastating ransomware attacks. According to ESET's investigation, which was corroborated by The Gentlemen's internal data leak in May 2026¹, the group has claimed 504 victims since its emergence in late 2025. The Gentlemen's technical infrastructure and tactics have established them as one of the most active ransomware operations in Q1 2026. The use of EDR-killer tools highlights the importance of operational resilience planning, as ransomware groups increasingly target security measures to maximize their impact. This shift in tactics poses a significant risk to organizations, making it essential for practitioners to reassess their security strategies and prioritize resilience planning to mitigate the threat of ransomware attacks.