Inside GentleKiller: The EDR-Killer Powering The Gentlemen
2026-06-21T14:51:46Z•3153f0f212d9725a99f4cb6c787bbb92f56bcdf68f416c04f95b18153a1aec17
BYOVDCISACVE-2026-20181CVE-2026-20253CVE-2026-42055CVE-2026-42530Cisco-ISEEDR-killerF5FortiBleedFortiGateFortinetGentleKillerKnown-Exploited-VulnerabilitiesNGINXSocGholishSplunkTheGentlemenVPNclipper-malware','crypto-clippercredential-leakdata-breachmass-credentialsransomwaretakedown
What happened
Multiple high-impact security events: active large-scale credential leaks and exploitation (FortiBleed leak of ~74,000 Fortinet device credentials; an exposed Elasticsearch cluster with ~24 billion stolen records) and ongoing active abuse. Several critical vulnerabilities were disclosed/patched and added to CISA/KEV (Splunk CVE-2026-20253 CVSS 9.8; Cisco ISE CVE-2026-20181 CVSS 9.1; NGINX-related CVE-2026-42530 and CVE-2026-42055 CVSS 9.2) with emergency updates urged. Emerging operational threats include The Gentlemen’s “GentleKiller” EDR-killer toolchain used to disable defenses ahead of BYO
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 3153f0f212d9725a99f4cb6c787bbb92f56bcdf68f416c04f95b18153a1aec17
- Enrichment time
- 2026-06-21T14:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.