Killing me gently: Inside Gentlemen’s EDR killer framework
2026-06-19T08:51:44Z•39176ce655f36126be295b8890634d75efebbc241fa8495ed9846865ab11c4a9
android-malwareauth-bypassbtmobcallphantomdriver-abuseedr-killereset-researcheviltokensfishmongerfrostyneighborgentlemen-raasgopherwhisperkernel-driverslegacy-otngateoceanlotusot-securityphishingransomwarescarcruftsprysockssupply-chainthreat-intelwebwormwindows-malware
What happened
ESET’s WeLiveSecurity feed (Jun 2026) highlights multiple high-impact research reports and advisories: an in-depth investigation of the 'Gentlemen' RaaS ecosystem and its EDR-killer framework that weaponizes vulnerable drivers to disable endpoint protection; discovery of SprySOCKS — a FishMonger backdoor that weaponizes a kernel driver for stealthy C2 and persistence; EvilTokens, a phishing kit that subverts Microsoft authentication flows to hijack accounts without stealing passwords; and a series of APT updates (OceanLotus, Webworm, GopherWhisper, FrostyNeighbor, ScarCruft, NGate) plus mobile
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- 39176ce655f36126be295b8890634d75efebbc241fa8495ed9846865ab11c4a9
- Enrichment time
- 2026-06-19T08:51:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.