Gentlemen RaaS Uses GentleKiller EDR Framework

The Gentlemen ransomware-as-a-service operation uses the GentleKiller framework to target 400 security processes. The group incorporates third-party tools like HexKiller and HavocKiller, and quickly operationalizes newly disclosed BYOVD exploits. Since March 2025, the group has claimed 504 victims, primarily in Southeast Asia, South America, and Western Europe.