Summary:

Researchers have identified StrikeShark, a previously undocumented global campaign that leverages a newly discovered malware loader, SharkLoader, to deploy Cobalt Strike Beacon on compromised systems. The campaign targets internet-facing applications and relies on malicious software installers for initial access.

SharkLoader uses advanced evasion techniques, including DLL sideloading, in-memory execution, and API hooking, to bypass security controls. Once deployed, it enables a persistent foothold, system reconnaissance, credential harvesting, and lateral movement. The campaign primarily targets government entities and software development organisations worldwide, posing significant risks to enterprises in the UAE and the broader MENA region that expose critical applications to the internet.

Technical Description:

GentleKiller is Gentlemen's in-house EDR-killer framework and the most prevalent tool within the group's ecosystem, with at least eight distinct variants identified to date. Each variant impersonates a different legitimate security product, using names and themes drawn from games and security vendors, and abuses a different vulnerable or malicious kernel-level driver through the Bring Your Own Vulnerable Driver (BYOVD) technique.

Despite the surface-level differences between variants, ESET classifies all samples under the GentleKiller umbrella due to their shared internal characteristics, including a process-killing loop that runs on a timer, identical code obfuscation, a common development template, and a unified evasion strategy applied at the compiled binary level. This includes Enigma or Themida commercial packing, fabricated version metadata, copied (invalid) digital signatures, and icons taken from the impersonated legitimate products. Applying evasion techniques to compiled binaries rather than source code allows Gentlemen to protect tools whose source code it does not own.

Additionally, ESET documented OxideHarvest (also known as buildx641), a Rust-based credential stealer believed to have been developed by an affiliate rather than the core operators. This separate tool can harvest credentials from Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Waterfox, and several other browsers.

Delivery and Infection Chain:

Gentlemen's distribution model differs fundamentally from how most Ransomware-as-a-Service (RaaS) operations handle defence evasion. Key confirmed characteristics of the operator-managed EDR-killer ecosystem include:

• While most ransomware gangs delegate EDR-killer sourcing to affiliates, Gentlemen operators develop and maintain a centralised, ready-to-use toolkit and distribute it directly to vetted affiliates, lowering the technical barrier to entry and accelerating affiliate recruitment with an unusually generous 90% revenue share.
• Gentlemen demonstrate an unusual ability to rapidly operationalise newly disclosed BYOVD proof-of-concept exploits. Tools tracked as UnknownKiller and PoisonKiller were incorporated into the GentleKiller arsenal within days of their public GitHub disclosure, a turnaround considerably faster than the weeks or months typically observed among other RaaS operators.
• Victim selection is driven by FortiGate endpoint misconfiguration rather than geography or sector, representing a structured, centrally managed targeting process rather than affiliates independently selecting victims.
• This targeted deployment approach has been linked to the group's use of a SystemBC proxy malware botnet comprising more than 1,570 hosts believed to be pre-compromised corporate environments.
• Gentlemen operators supply affiliates with both a Go-based ransomware encryptor for Windows and Linux and a C-written variant for VMware ESXi, alongside the EDR-killer suite, providing a complete end-to-end intrusion-to-encryption toolkit.

Technical Capabilities:

GentleKiller and its integrated third-party tools rely on the Bring Your Own Vulnerable Driver (BYOVD) technique, whereby a legitimately signed but vulnerable kernel driver is loaded onto the host, granting the attacker kernel-level privileges that bypass user-mode security controls. Once loaded, the malicious process runs a timer-based termination loop that continuously enumerates and terminates targeted EDR and antivirus processes, ensuring that even if a security product is restarted, it is repeatedly disabled.

Each tool within the suite is protected using commercial binary packers (Enigma or Themida) and disguised with fabricated version information, invalid copied digital signatures, and icons taken from the impersonated legitimate security vendor, making static identification considerably more difficult for defenders. Because the evasion layer is applied to compiled binaries rather than source code, Gentlemen can standardise and protect third-party or leaked tools (HexKiller, ThrottleBlood, and HavocKiller) to the same extent as its own GentleKiller framework, despite not owning their source code.

Attribution and Evolution:

Gentlemen emerged in late 2025 and quickly became one of the five most active ransomware groups during Q1 2026. The operation was reportedly founded by a former Qilin affiliate and includes members from several established ransomware gangs. Gentlemen employ double-extortion tactics, encrypting data while threatening to leak stolen information if ransom demands are not met, and offers affiliates a lucrative 90% revenue share.

The group has been linked to the compromise of Romanian energy provider Oltenia and to a SystemBC botnet comprising more than 1,570 compromised hosts used to maintain persistent access to victim networks.

Active Campaign and Geographic Spread:

Unlike most top-tier ransomware operations such as Qilin, DragonForce, and Akira, which derive nearly half of their publicly disclosed victims from the United States, Gentlemen's victimology is notably less US-focused. The group's targets are concentrated in Southeast Asia, South America, and Western Europe, including documented victims in Thailand, Brazil, and France.

Leaked internal data indicates that this is not coincidental. The group selects targets primarily based on FortiGate endpoint misconfiguration rather than geography or sector, pointing to a centrally managed, technically driven targeting strategy rather than opportunistic affiliate selection.

Organisations in the UAE and MENA region operating FortiGate VPN infrastructure alongside Windows endpoints protected by Microsoft Defender or third-party EDR/AV solutions should treat this as directly relevant targeting criteria, irrespective of sector.

Conclusion:

Gentlemen's centralised EDR-killer ecosystem represents a significant evolution in ransomware operations by providing affiliates with ready-to-use defence-evasion capabilities. By maintaining GentleKiller and supporting tools within a unified framework, the group reduces the level of technical expertise required by affiliates while rapidly weaponising newly disclosed BYOVD vulnerabilities.

Organisations should prioritise driver-level, behaviour-based, and signature-agnostic detection rather than relying solely on tool-specific signatures. UAE and MENA organisations using FortiGate infrastructure and Windows EDR solutions should prioritise driver allowlisting, vulnerable driver monitoring, and BYOVD-focused detection as immediate defensive measures.

Impact:

Successful deployment of GentleKiller or other tools in the Gentlemen EDR-killer suite can disable security software from more than 48 vendors, including Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Palo Alto Networks, ESET, and Bitdefender. By abusing legitimately signed but vulnerable drivers, the toolkit operates at the kernel level, allowing attackers to bypass many traditional security controls. Once defences are disabled, affiliates can exfiltrate sensitive data and deploy ransomware across Windows, Linux, and ESXi environments with a significantly lower likelihood of detection.

For UAE and MENA organisations, a successful compromise could result in widespread network encryption, large-scale data theft, operational disruption, and the public release of stolen information if ransom demands are not met. Effective mitigation requires driver-level blocklisting, application allowlisting, continuous monitoring for BYOVD activity, and hardening of internet-facing infrastructure, such as FortiGate devices, that may be targeted for initial access.

IOC and Context Details:

Recommended Actions:

• Turn on HVCI/WDAC across all Windows endpoints. This blocklist effectively addresses BYOVD attacks by blocking known vulnerable drivers, including those used by GentleKiller, HexKiller, ThrottleBlood, and HavocKiller.
• Use WDAC or AppLocker to restrict driver execution exclusively to an explicitly approved list. This prevents unlisted or newly generated GentleKiller variants from executing.
• Configure SIEM rules to alert when unexpected or unrelated vendor drivers are loaded (for example, a Baidu Antivirus or Huawei Audio driver on a standard corporate endpoint). Correlate these events with sudden EDR or antivirus service termination.
• Harden FortiGate deployments by thoroughly auditing internet-facing FortiGate firewalls and VPN appliances to eliminate configuration errors. Apply all vendor security patches promptly to reduce the risk of edge exploitation.
• Treat any detection of SystemBC proxy traffic or binaries as a high-severity security incident. This is a strong indicator that the environment may be undergoing preparation for EDR-killer deployment and a subsequent ransomware attack.
• Tune SIEM tools to generate immediate high-priority alerts if indicators associated with multiple EDR-killing tools (such as ThrottleBlood and GentleKiller components) are detected within the same environment.
• Ensure tamper-protection controls are enabled across the entire endpoint security platform. Confirm that permissions prevent local administrators from disabling or bypassing these monitoring mechanisms.
• Maintain active threat intelligence processes to monitor emerging vulnerability proof-of-concept releases. Since Gentlemen integrates newly disclosed public tools into its toolkit within days of publication, defensive engineering for vulnerable driver exploits should be highly proactive.

Reference:

https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/

https://thehackernews.com/2026/06/the-gentlemen-raas-uses-gentlekiller.html

https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/

https://www.helpnetsecurity.com/2026/06/18/eset-gentlemen-edr-killers/