Executive summary
Unit 42's assessment published on 10 July 2026 describes The Gentlemen ransomware operation using varied initial-access routes and custom tooling across intrusions. ESET's technical investigation published on 18 June 2026 identifies an operator-maintained portfolio of endpoint detection and response (EDR) disabling tools, centred on the framework it names GentleKiller. ESET distinguishes that internally developed framework from incorporated third-party tools and cautions against inferring relationships between ransomware groups from tool sharing alone. We assess it is likely (B2) that investigating security-agent failure as a possible intrusion event will be more useful than relying on a single GentleKiller filename, because the observed portfolio spans multiple drivers and standardised disguises.
Context: affiliate activity and operator-provided tooling
Unit 42's July assessment describes ransomware-as-a-service (RaaS), in which operators supply capabilities to affiliates conducting intrusions. Its reported initial-access methods include exploiting internet-facing edge devices, brute-force attacks, stolen credentials and relationships with initial access brokers. This range argues against assuming that every Gentlemen investigation begins with the same appliance flaw or access route.
ESET's investigation focuses on a narrower and technically distinctive part of the operation: tools supplied to affiliates to disrupt security software. ESET says incident-level observations across unrelated intrusions supported its assessment of central maintenance, and that internal material leaked in May 2026 later corroborated it. The research does not depend solely on a criminal advertisement of capability.
ESET describes double extortion through encryption and threatened publication of stolen information. Criminal victim announcements are therefore part of the pressure mechanism, but they are not interchangeable with independently verified incidents. This article uses the researchers' technical observations to frame defensive work and does not present a criminal posting total as a confirmed population of breached organisations.
Technical analysis
A portfolio reduces dependence on one disabling tool
ESET first observed a previously undocumented tool in a GentlemenCollection directory during a February 2026 intrusion and named it GentleKiller. It subsequently saw the same staging pattern in further Gentlemen affiliate activity. At publication, the researchers identified at least eight variants using different vulnerable or malicious drivers while retaining common internal structure and behaviour.
The described pattern is broader than a particular vulnerable-driver file. ESET reports recurring process-termination logic, shared obfuscation and a substantial set of security processes that the tool can target. It also describes quick adaptation of publicly disclosed driver-abuse techniques. These are properties of the analysed tools; they do not establish that every supported action succeeded in every intrusion.
Our recommended investigation starts with what changed on the host: newly installed driver services, execution of unfamiliar binaries and the subsequent health of security processes. Collecting those relationships preserves useful evidence even when an attacker changes the surface filename or selects another variant from the portfolio.
Disguises do not create valid trust
ESET describes filenames, icons and fabricated version information designed to resemble legitimate vendors, particularly security products. Samples also carry copied digital-signature information that does not constitute a valid signature. The distinction matters: a familiar publisher name in file metadata is different from successful validation of the file's signing status.
The researchers report that a significant portion of observed samples used Enigma or Themida protection. They also identify variants with less protection or without the same impersonation layer. We recommend comparing file origin, signature validation, execution path and behaviour rather than requiring every sample to exhibit an identical combination of disguises.
For analysts, the immediate question is whether an apparently protective utility has an authorised installation history and expected purpose. An executable resembling an antivirus component but arriving alongside an unexplained driver and security-agent termination deserves examination. That is a proposed behavioural correlation, not a claim that a vendor name alone is an indicator of compromise.
Third-party tools complicate attribution
ESET includes HexKiller, ThrottleBlood and HavocKiller in the operator's portfolio, while assessing them as externally obtained rather than internally developed GentleKiller variants. It explicitly says HexKiller's appearance does not itself demonstrate collaboration with another ransomware gang. The researchers also separate an observed affiliate-specific tool from the centrally maintained suite when the evidence does not support that link.
This is a useful boundary for incident reporting. Finding a tool can establish that a capability was present; it may not establish who supplied it or which criminal organisation directed the intrusion. Our recommendation is to retain host, account, staging and deployment context when submitting samples for analysis. Attribution should follow that combined evidence rather than a shared executable alone.
Credential access may accompany defence impairment
ESET also describes OxideHarvest, a Rust credential stealer that it links to a Gentlemen affiliate rather than attributing development to the operators. The tool accepts credentials and a host list, accesses those hosts and collects browser-related credentials according to its configuration. This is separate from GentleKiller's security-disabling role.
For defenders, that separation prevents a misleading recovery boundary. A host containing an EDR-disabling tool may require investigation for other deployed capabilities, including credential collection. We recommend preserving suspicious files and their execution context before removal, then scoping credential exposure from the evidence rather than assuming that all observed tooling performed the same function.
Impact and limits of the public evidence
ESET's observations support concern about interruption of protective controls. Unit 42's assessment adds operational priorities across access, credentials, internal discovery, virtual infrastructure and recovery. Neither source establishes that every Gentlemen affiliate uses every listed method or that each attempted security-tool disruption succeeds.
A useful incident record should therefore distinguish attempted impairment, confirmed service failure and demonstrated loss of visibility. We recommend recording the last reliable telemetry, the time of any driver or service change and which independent sources still functioned. A missing endpoint event after a confirmed agent failure is a visibility limitation, not affirmative evidence that the host was inactive.
The business impact also requires organisation-specific evidence. Encryption, stolen information and interrupted operations should be reported separately when confirmed. Criminal threats may create urgency, but they should not determine the technical finding or substitute for verification of what systems and data were affected.
Indicators and detection opportunities
ESET supplies sample hashes and driver details in its full report. The examples below are hunting leads, with qualifications intended to prevent normal administration from being treated as malicious solely because of a filename.
| Observation | Investigative value | Qualification |
|---|---|---|
GentlemenCollection staging directory |
Connect files and deployment activity observed by ESET | Preserve contents, timestamps and originating account |
| New driver service followed by security-process termination | Examine the reported driver-assisted impairment pattern | Determine whether the installation and process change were authorised |
| Familiar vendor metadata with invalid signature validation | Test the impersonation described in ESET's analysis | Metadata text alone is not proof of valid signing |
Unexpected buildx641.exe or buildx64.exe |
Compare with ESET's OxideHarvest samples and hashes | Do not attribute a file from its generic name alone |
Scheduled task names beginning gentlemen |
Follow Unit 42's proposed alerting guidance | Investigate creation, deletion and execution with context |
Unit 42 recommends monitoring unexpected unsigned or vulnerable-driver loads and enabling EDR tamper protection. It also recommends alerts for Windows event-log clearing and monitoring internal discovery with tools such as Advanced IP Scanner. Those are defensive recommendations in its report, not proof that every such event belongs to this operation.
Immediate response
First, preserve evidence of the control failure. We recommend collecting the suspicious binary and driver, service records, available endpoint history, central logs and relevant account activity. If the host's own security agent is impaired, consult independently retained network and identity records rather than relying exclusively on that host's current status.
Second, contain the affected system and examine the preceding access. Unit 42's list of initial-access methods means the investigation should consider exposed infrastructure and credential misuse as applicable. Do not stop after removing an EDR killer if the account or remote route that delivered it remains available.
Third, investigate adjacent activity. Look for other systems receiving the same staged files, related administrative sessions and credential access. ESET's distinction between central tools and affiliate additions supports examining the whole local toolset. Record what actually executed instead of treating every recovered file as an executed capability.
Fourth, establish a trusted recovery path. Restore protective controls, verify that the host reports correctly and validate offline backups before depending on them. Unit 42 specifically recommends maintained and tested offline recovery capability. Our additional recommendation is to check that restored systems do not inherit the compromised access path or unexplained driver state.
ATT&CK context
The behaviour ESET describes maps to Disable or Modify Tools, T1685, which covers impairment of defensive tools. Its use of copied but invalid signature information maps to Invalid Code Signature, T1036.001. ESET includes these mappings in its version 19 ATT&CK table.
The two techniques address different questions: whether protection was interfered with, and whether the tool presented misleading trust cues. Use them to organise telemetry and validation. Neither mapping is an actor identity, and neither proves that a particular recovered sample successfully disabled the security product installed in the affected environment.
Mitigation priorities
Unit 42 recommends strong authentication, credential review and rotation, maintained visibility of internet-facing services and investigation of earlier edge-device exploitation. Those measures address access and reuse, while tamper protection and driver monitoring address a later stage. We recommend testing the controls together so that a blocked impairment attempt still triggers investigation of how the tool arrived.
For lateral movement, Unit 42 recommends Server Message Block (SMB) signing, removal of SMB version 1 and restrictions between internal network segments. For VMware ESXi, it recommends leaving Secure Shell (SSH) disabled except for explicit maintenance and isolating management interfaces on a dedicated management virtual local area network (VLAN). These are the report's hardening priorities, not claims that every Gentlemen intrusion compromised a hypervisor.
Recovery planning should also exercise the loss of a primary security sensor. Identify which logs remain available, who can isolate a system and how administrative changes are authorised during an incident. This is our operational recommendation derived from the reported focus on disabling protective tools.
Outlook
The important development is the maintained supply of multiple impairment tools to affiliates, supported by ESET's repeated intrusion observations. Unit 42's July 2026 assessment reinforces the need to examine access, credentials and recovery alongside the payload itself. The public record supports concern about the capability without requiring a speculative ranking of criminal success.
Our likely (B2) judgement is that behavioural correlation around security-tool failure will remain useful as variants and disguises change. The supporting evidence is the common impairment objective across ESET's diverse samples. The uncertainty is how individual affiliates deploy them and how particular defensive configurations respond; both require local validation.
