June 21, 2026
- ESET published a deep dive on the Gentlemen RaaS's EDR-killer portfolio, centered on the in-house GentleKiller framework (eight variants, each impersonating a different legitimate product) and supplemented with HexKiller, ThrottleBlood, and HavocKiller. Across builds it targets 400+ processes mapped to 48 security products; leaked Gentlemen data confirmed GentleKiller as an internal tool and linked one affiliate to a stealer ESET named OxideHarvest. IoCs are on GitHub (WeLiveSecurity, BleepingComputer).
· Ransomware & EDR Evasion
in FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog
June 20, 2026
- ESET dissected GentleKiller, the in-house EDR-killer at the core of the Gentlemen RaaS portfolio — eight variants, each impersonating a legitimate product, collectively targeting 400+ processes mapped to 48 security products, and combined with externally sourced HexKiller, ThrottleBlood, and HavocKiller. A leak of Gentlemen's own data also linked an affiliate to a stealer ESET named OxideHarvest; IoCs are published. The Hacker News, WeLiveSecurity
· Ransomware & Extortion
in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token
June 19, 2026
- ESET dissected the Gentlemen RaaS EDR-killer framework: in-house GentleKiller (8 variants, each impersonating a legit product, targeting 400+ processes) plus externally sourced HexKiller, ThrottleBlood and HavocKiller; a recent data leak confirmed the toolset and linked an affiliate to a stealer dubbed OxideHarvest. The gang focuses on Southeast Asia, South America and Western Europe (BleepingComputer, ESET/WeLiveSecurity).
· Ransomware
in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk