Inside GentleKiller: The EDR-Killer Powering The Gentlemen

2026-06-21T02:51:46Z2ceb896a6ef53a1672ca64212ff85aee455ac77c6b261012f876c851727fc230
BYOVDCISACisco-ISEEDR-killerF5FortiBleedFortinetGentleKillerKnown-Exploited-VulnerabilityNGINXPeter-Thiel-Dialog-leakSocGholishSplunkactive-exploitationclipper-malwarecredential-leakcredential-sprayingcrypto-theftdata-breachvulnerability-patch

What happened

Multiple high-impact security events: ESET and leaked internal data detail GentleKiller, an EDR-killer suite (BYOVD-enabled) used to disable endpoint defenses ahead of ransomware; FortiBleed exposed credentials for ~74,000 Fortinet devices with active exploitation observed; and law enforcement disrupted SocGholish, cleaning ~14,971 WordPress sites. Major data breaches and malware reports include an exposed 24-billion-record credentials collection and a Tor-based clipper targeting crypto seed phrases. Multiple critical vulnerabilities were disclosed and patched or added to CISA’s KEV: Splunk CV

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
securityaffairs
Record identifier
2ceb896a6ef53a1672ca64212ff85aee455ac77c6b261012f876c851727fc230
Enrichment time
2026-06-21T02:51:46Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.