The Gentlemen ransomware operation is abusing legitimate Lenovo and Safetica kernel drivers to terminate security software, weakening endpoint defenses before encryption.
Acronis Threat Research Unit researchers identified two custom dropper samples during a recent incident, exposing how the group weaponizes vulnerable drivers rather than relying exclusively on conventional process termination commands
The technique, known as BYOVD, or bring your own vulnerable driver, turns trusted software components into privileged attack tools.
In this incident, the malicious loaders installed drivers as services, enumerated running processes, and submitted termination requests when process names matched hardcoded security targets.
The samples deployed Safetica’s ProcessMonitorDriver version 11.26.18 and Lenovo’s BootRepair.sys version 2.5.30.11281.
Their dropped filenames were STProcessMonitorNew_clone_03_FC21F904.sys and PhantomKiller_clone_04_94354C0F.sys, respectively.
Safetica’s driver exposes an insufficiently protected input/output control interface that allows process termination, tracked as CVE-2025-70795. Safetica lists the issue in its security knowledge base.
Lenovo’s driver similarly exposes a device interface capable of terminating arbitrary processes through an unauthenticated IOCTL handler.
Before deployment, the dropper recovers embedded filenames and paths through an XOR-based deobfuscation routine.
Numerous conditional branches complicate analysis, but the underlying operation repeatedly derives a key and transforms encoded data.
After loading the driver, the malware compares running process names against its target list. For matching entries, it passes the process identifier through an IOCTL request.
Acronis Researchers observed that, the Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) threat provider that first emerged in mid-2025.
Lenovo Drivers Exploited
The driver then invokes ZwOpenProcess and ZwTerminateProcess, moving the termination operation into kernel context.
Sample sets the highest process priority for itself using ‘SetPriorityClass’ with value ‘80’, which refers to HIGH_PRIORITY_CLASS.
The findings describe exploitation of vulnerable components, not evidence that Lenovo or Safetica distributed the ransomware.
The Russian-speaking group emerged under its own ransomware brand in mid-2025 after reportedly participating in LockBit and Qilin affiliate operations.
Previously known as ArmCorp and Phantom Mantis, it offers affiliates up to 90% of ransom proceeds.
According to the supplied research, the operation has claimed more than 800 victims, particularly in the United States and Europe.
Leaked data is organized into folders containing stolen, unencrypted files that anyone visiting the site can download. The site also provides links and QR codes to SimpleX and Tox chats used to communicate with the threat actors.
Those figures represent criminal claims rather than independently verified compromises manufacturing, technology, healthcare, professional services, and retail feature prominently among reported targets.
Its Go-based ransomware supports Windows, Linux, NAS, and BSD environments.
A May 2026 breach of the group’s infrastructure reportedly exposed internal communications, negotiations, affiliate information, and tooling discussions, providing additional visibility into its organization and Qilin ecosystem connections.
The ransomware also disables Microsoft Defender monitoring, adds broad exclusions, clears event logs, and removes PowerShell command histories.
It targets database, virtualization, backup, and security processes while deleting Volume Shadow Copies to obstruct recovery.
Persistence includes UpdateSystem and UpdateUser scheduled tasks alongside GupdateS and GupdateU registry Run entries. Optional propagation uses PowerShell and PsExec to reach additional workstations.
Related Check Point research documents comparable Defender suppression, persistence, and lateral movement in Gentlemen intrusions.
File encryption uses ChaCha20 with per-file keys and nonces. The analyzed build appends the .cyvzca extension and drops README-GENTLEMEN.txt ransom notes, although extensions vary between builds.
For defenders, the central concern is coordinated security impairment: driver loading, endpoint termination, backup disruption, and encryption operate as complementary stages.
Monitoring unexpected kernel-driver services alongside sudden security-process exits and Defender configuration changes can help connect these activities before encryption dominates the incident.
The Acronis investigation ties these technical findings to the group’s broader double-extortion operation, where stolen information creates additional leverage beyond encrypted systems alone.
Indicators of compromise
| Category | SHA-256 Hash |
|---|---|
| Windows | 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f |
| Windows | 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 |
| EDR killer | 143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676 |
| EDR killer | a1500204822fb16556a274132d802ba18a7e8b95cf134bd17b473f915e8cda81 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
