A Ransomware Gang With 483 Victims and a Growing Toolkit

A ransomware operation known as The Gentlemen has reportedly compromised 483 victims by combining two distinct pieces of malicious tooling: a defense-evasion utility called GentleKiller and a remote access trojan named EtherRAT. Together, these tools allow the group to disable security software on a target's machine and maintain covert command-and-control communication that is harder for defenders to shut down.

The group, which security researchers have also linked to attacks on organizations like the Dutch ice stadium covered in our report on The Gentlemen ransomware gang's attack on Thialf, has been steadily expanding its reach. Rather than relying on a single novel exploit, the gang's success appears to come from stacking several well-known evasion techniques into one automated package, then reusing that package across a large number of targets.

How GentleKiller Defeats Security Software

At the center of this campaign is GentleKiller, a tool built around a technique commonly called BYOVD, or "Bring Your Own Vulnerable Driver." In simple terms, attackers install a legitimate but flawed hardware or software driver onto a victim's computer. Because that driver is often digitally signed and trusted by Windows, it can run with deep system-level privileges. The attackers then exploit a known weakness in that driver to shut down or blind security software running on the machine, effectively turning a trusted piece of software into a weapon against the very tools meant to stop it.

According to reporting on this campaign, GentleKiller has been used to defeat 48 different security vendors' products. That number matters because it suggests the tool was not designed to evade one or two specific antivirus programs. Instead, it was built as a broad, reusable framework capable of neutralizing a wide swath of the endpoint protection market. This mirrors a pattern we've tracked before in our coverage of how The Gentlemen ransomware blinds EDR tools, where the group's operators have shown a consistent interest in disabling detection before deploying their actual encryption payload.

EtherRAT and the Blockchain Twist

The second component, EtherRAT, handles command-and-control (C2) communication, the channel attackers use to send instructions to infected machines and receive stolen data or status updates back. What sets EtherRAT apart is its reported use of blockchain infrastructure for this purpose. Traditional C2 servers can be identified and taken down by researchers or law enforcement once discovered. By routing communication through blockchain-based mechanisms, attackers make that kind of takedown significantly harder, since blockchain data is distributed and resistant to a single point of shutdown.

This combination, a driver-based defense killer paired with a resilient C2 channel, reflects a broader trend among ransomware-as-a-service operations: build once, sell or license widely, and let affiliates run large-scale campaigns against a variety of targets, including the small and mid-sized businesses that are increasingly being singled out by groups competing for market share, as we detailed in our piece on Qilin and The Gentlemen escalating SMB attacks.

What This Means For You

If you manage IT systems for a business, or even just care about your home network's security, the core lesson here isn't specific to The Gentlemen. It's about the limits of relying on any single security product. A tool capable of defeating 48 different vendors demonstrates that antivirus or endpoint detection software alone cannot be treated as a complete defense.

For individuals, the practical risk is lower but not zero: ransomware groups often gain initial access through phishing emails, exposed remote access services, or unpatched software, the same entry points that put personal data and home networks at risk. Keeping systems updated, using unique passwords, and being cautious about unsolicited attachments remains foundational protection regardless of how sophisticated the backend malware becomes.

For organizations, this campaign is a reminder that paying a ransom does not guarantee safety going forward. As covered in our earlier analysis of a Proofpoint study on ransomware payers, roughly one in three companies that pay a ransom get targeted again. Layered defenses, offline backups, and driver allow-listing policies that restrict which kernel-level drivers can load are far more durable protections than hoping a single security tool will catch every threat.

Takeaways

  • Don't rely on one security product; layered defenses matter more when attackers specifically design tools to bypass individual vendors.
  • Restrict which drivers can load on your systems, since BYOVD attacks depend on installing outside drivers with kernel access.
  • Keep offline, tested backups so a ransomware infection doesn't force a payment decision.
  • Treat unexpected emails, links, and remote access requests with suspicion, since initial access still typically starts with basic social engineering or unpatched software.
  • Stay informed on groups like The Gentlemen ransomware operation, since their tools and targets continue to evolve.