← threat actors
threat actor · not yet in the cluster map
gentlemen
4 stories · 3 in the wild · June 19, 2026 – September 3, 2026
evidence: 3 observed · 1 disclosed
sectors
- healthcare 1 · Sep 3
- security vendors 1 · Jul 29
geography
- south america 1 · Jun 19
- southeast asia 1 · Jun 19
- western europe 1 · Jun 19
malware and tools
- havockiller 2 · Jun 21
- hexkiller 2 · Jun 21
- oxideharvest 2 · Jun 21
- throttleblood 2 · Jun 21
- gentlemen 1 · Sep 3
- gentelkiller 1 · Jul 29
- gentletkiller 1 · Jun 21
- gentilekiller 1 · Jun 19
techniques
- defense evasion 2 · Jul 29
- data exfiltration 1 · Sep 3
- ransomware 1 · Sep 3
- driver abuse 1 · Jul 29
- persistence 1 · Jun 21
- edr evasion 1 · Jun 19
attack phases seen
- Defense evasion 3 · Jul 29
- Exfiltration 1 · Sep 3
- Impact 1 · Sep 3
- Privilege escalation 1 · Jul 29
what we reported, newest first, grouped by story
September 3, 2026
- Nutex Health confirms exfiltration in an SEC filing, covering patient, employee, credentialed-provider and business data, with the Gentlemen ransomware group threatening publication (SEC 8-K, SecurityWeek).
· Sep 3 · observed · Breaches & Leaks
July 29, 2026
- ESET is tracking 100+ EDR killers, with 60+ still relying on BYOVD against legitimate-but-vulnerable drivers. The team notes the Gentlemen gang runs a shared defense-evasion layer — in-house GentleKiller plus third-party and leaked tools — and can operationalize new BYOVD PoCs within days, a supply they expect to grow as actors weaponize thousands of vulnerable drivers with AI coding assistance (ESET).
· Jul 29 · observed · Threat Activity
Jun 19 – June 21, 2026 · 2 reports
- ESET published a deep dive on the Gentlemen RaaS's EDR-killer portfolio, centered on the in-house GentleKiller framework (eight variants, each impersonating a different legitimate product) and supplemented with HexKiller, ThrottleBlood, and HavocKiller. Across builds it targets 400+ processes mapped to 48 security products; leaked Gentlemen data confirmed GentleKiller as an internal tool and linked one affiliate to a stealer ESET named OxideHarvest. IoCs are on GitHub (WeLiveSecurity, BleepingComputer).
· Jun 21 · disclosed · Ransomware & EDR Evasion
- ESET dissected the Gentlemen RaaS EDR-killer framework: in-house GentleKiller (8 variants, each impersonating a legit product, targeting 400+ processes) plus externally sourced HexKiller, ThrottleBlood and HavocKiller; a recent data leak confirmed the toolset and linked an affiliate to a stealer dubbed OxideHarvest. The gang focuses on Southeast Asia, South America and Western Europe (BleepingComputer, ESET/WeLiveSecurity).
· Jun 19 · observed · Ransomware