The Gentlemen ransomware-as-a-service uses the GentleKiller EDR framework targeting 400 security processes

The Gentlemen ransomware-as-a-service operation develops and maintains EDR-terminating tools that affiliates use to impair system defenses before deploying the encryptor. Its central GentleKiller framework has eight variants that target 400 processes associated with 48 security programs. The operation uses BYOVD techniques and is described by the source as actively developing and operating.