The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

{"# A Sophisticated Attack Framework":"The Gentlemen RaaS operation has developed a suite of endpoint detection and response (EDR) killers, including eight variants of GentleKiller, to target security processes. These tools are designed to evade detection by impersonating legitimate vendors.","

Impersonation Techniques":"GentleKiller uses fake version information, copied certificates, and icons to mimic legitimate products. This approach makes it difficult for EDR systems to identify the malicious activity.","

Targeted Security Processes":"The Gentlemen RaaS operation targets 400 processes associated with 48 distinct security programs. These include Kaspersky, FACEIT Anti-Cheat, and other popular security vendors' products. The use of BYOVD (Bring Your Own Vulnerable Driver) techniques further complicates detection.","# Operational Flexibility":"The Gentlemen RaaS group centralizes the EDR-killer function by offering a standardized suite to affiliates. This decision makes it easier for affiliates to integrate these tools into their operations, reducing development effort and operational flexibility.","# BYOVD Attacks":"The Gentlemen RaaS operation has used BYOVD techniques in multiple campaigns, including one that targeted CrowdStrike Falcon EDR. The use of drivers like 'PoisonX.sys' allows them to terminate security tooling before deploying the encryptor.","# Vulnerable UEFI Applications":"CERT/CC issued an advisory about vulnerabilities in vendor-signed UEFI applications that can be exploited for Secure Boot bypass via BYOVD attacks. This highlights the importance of updating the UEFI Forbidden Signature Database (DBX) to prevent vulnerable applications from executing during boot."}