/
← Voltar ao feed
high manufacturing technology healthcare professional services retail

Gentlemen ransomware uses vulnerable Lenovo and Safetica drivers (BYOVD) to kill security software before encryption

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 09:21 · coletado há 15 horas

Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the drivers as services, enumerate running processes and send termination requests when process names match a hardcoded list of security targets. Gentlemen is a Russian-speaking RaaS that emerged in mid-2025 (formerly ArmCorp / Phantom Mantis), offers affiliates up to 90% of ransom proceeds and claims more than 800 victims, mainly in the United States and Europe. The article stresses that the findings describe abuse of vulnerable components, not distribution of the ransomware by Lenovo or Safetica, and that the victim figures are criminal claims.

Detalhes técnicos

  • Drivers abused: Safetica ProcessMonitorDriver 11.26.18 (dropped as STProcessMonitorNew_clone_03_FC21F904.sys), whose insufficiently protected IOCTL interface allows process termination (CVE-2025-70795), and Lenovo BootRepair.sys 2.5.30.11281 (dropped as PhantomKiller_clone_04_94354C0F.sys), which exposes an unauthenticated IOCTL handler that can terminate arbitrary processes.
  • The dropper recovers embedded filenames and paths with an XOR-based deobfuscation routine and many conditional branches to hinder analysis. It sets itself to HIGH_PRIORITY_CLASS with SetPriorityClass.
  • After the driver loads, the matching process ID is passed through an IOCTL request and the driver calls ZwOpenProcess and ZwTerminateProcess, so termination runs in kernel context.
  • The Go-based ransomware targets Windows, Linux, NAS and BSD. It disables Microsoft Defender monitoring, adds broad exclusions, clears event logs and PowerShell command histories, targets database, virtualization, backup and security processes, and deletes Volume Shadow Copies.
  • Persistence: UpdateSystem and UpdateUser scheduled tasks plus GupdateS and GupdateU registry Run entries. Optional propagation uses PowerShell and PsExec.
  • Encryption uses ChaCha20 with per-file keys and nonces. The analyzed build appends .cyvzca and drops README-GENTLEMEN.txt; extensions vary between builds.
  • Operations are double extortion, with a leak site offering stolen files for download and SimpleX and Tox contact links. A May 2026 breach of the group's infrastructure reportedly exposed internal communications, negotiations and affiliate information, and showed links to the Qilin ecosystem. Related Check Point research documents similar Defender suppression, persistence and lateral movement.

Remediação

  • Monitor for unexpected kernel-driver service installations, sudden exits of security processes and changes to Defender configuration, which together can reveal the intrusion before encryption starts.
  • Watch for scheduled task and registry Run persistence, Volume Shadow Copy deletion and PsExec lateral movement.
  • Review the Safetica knowledge base entry for CVE-2025-70795 and track the vulnerable Lenovo driver version.

Linha do tempo

  1. gbhackers.com ↗ · pub. 21/10/2026 09:21 · coletado 21/10 10:00 primeiro registro

    Gentlemen ransomware uses vulnerable Lenovo and Safetica drivers (BYOVD) to kill security software before encryption

    ler a análise desta fonte

    Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the drivers as services, enumerate running processes and send termination requests when process names match a hardcoded list of security targets. Gentlemen is a Russian-speaking RaaS that emerged in mid-2025 (formerly ArmCorp / Phantom Mantis), offers affiliates up to 90% of ransom proceeds and claims more than 800 victims, mainly in the United States and Europe. The article stresses that the findings describe abuse of vulnerable components, not distribution of the ransomware by Lenovo or Safetica, and that the victim figures are criminal claims.

    Technical Details

    • Drivers abused: Safetica ProcessMonitorDriver 11.26.18 (dropped as STProcessMonitorNew_clone_03_FC21F904.sys), whose insufficiently protected IOCTL interface allows process termination (CVE-2025-70795), and Lenovo BootRepair.sys 2.5.30.11281 (dropped as PhantomKiller_clone_04_94354C0F.sys), which exposes an unauthenticated IOCTL handler that can terminate arbitrary processes.
    • The dropper recovers embedded filenames and paths with an XOR-based deobfuscation routine and many conditional branches to hinder analysis. It sets itself to HIGH_PRIORITY_CLASS with SetPriorityClass.
    • After the driver loads, the matching process ID is passed through an IOCTL request and the driver calls ZwOpenProcess and ZwTerminateProcess, so termination runs in kernel context.
    • The Go-based ransomware targets Windows, Linux, NAS and BSD. It disables Microsoft Defender monitoring, adds broad exclusions, clears event logs and PowerShell command histories, targets database, virtualization, backup and security processes, and deletes Volume Shadow Copies.
    • Persistence: UpdateSystem and UpdateUser scheduled tasks plus GupdateS and GupdateU registry Run entries. Optional propagation uses PowerShell and PsExec.
    • Encryption uses ChaCha20 with per-file keys and nonces. The analyzed build appends .cyvzca and drops README-GENTLEMEN.txt; extensions vary between builds.
    • Operations are double extortion, with a leak site offering stolen files for download and SimpleX and Tox contact links. A May 2026 breach of the group's infrastructure reportedly exposed internal communications, negotiations and affiliate information, and showed links to the Qilin ecosystem. Related Check Point research documents similar Defender suppression, persistence and lateral movement.

    Remediation

    • Monitor for unexpected kernel-driver service installations, sudden exits of security processes and changes to Defender configuration, which together can reveal the intrusion before encryption starts.
    • Watch for scheduled task and registry Run persistence, Volume Shadow Copy deletion and PsExec lateral movement.
    • Review the Safetica knowledge base entry for CVE-2025-70795 and track the vulnerable Lenovo driver version.