A ransomware group calling itself The Gentlemen is taking an unusually aggressive approach to disabling defenses before it ever touches a victim’s files. Rather than betting purely on fast, stealthy encryption, the group is deploying a custom kernel-level driver designed to methodically kill the security software that would otherwise catch it in the act.

A Driver Built to Blind Defenders

Researchers at threat intelligence firm Catalyst identified the component, tracked as anticheatG13.sys, and shared their findings with Cyber Security News. The file is a kernel-level driver with broad capabilities for manipulating processes, network connections, files, and system memory. Catalyst notes that it builds on an earlier, related component called G12drv.sys, suggesting the operators have been iterating on this tooling over time rather than building it from scratch for a single campaign.

The group’s initial access method has not been publicly detailed, but once attackers gain a foothold, the driver appears to be a deliberate second stage — used to prepare a system for encryption by stripping away anything that could interfere.

Nearly 180 Security Processes Targeted

According to Catalyst’s analysis, the driver is capable of terminating close to 180 distinct security-related processes before file encryption begins. That list can include antivirus engines, endpoint detection and response (EDR) agents, backup software, and general monitoring tools. The driver reportedly runs process termination through a system worker and waits to confirm the result, indicating this is a deliberate, verified step in the attack chain rather than a best-effort attempt.

Notably, the driver also supports destructive process-memory operations, giving attackers a fallback way to disrupt targeted applications even if a straightforward termination attempt fails. The practical effect is the same either way: by the time file encryption starts, the tools that would normally alert defenders, log forensic evidence, or automatically contain the intrusion have often already been silenced.

Capabilities Extend Beyond Killing Processes

Catalyst’s report describes functionality that goes well beyond disabling security software. The driver reportedly supports:

• Windows Filtering Platform connection redirection and address whitelisting
• Command-line rewriting and staged data transfer features
• System enumeration and file-operation controls
• Minifilter management and kernel-memory modification
• Inspection of driver loads, with the ability to block selected drivers from loading

That last capability places The Gentlemen within a broader and increasingly common trend: abusing highly privileged, trusted or vulnerable Windows drivers to disable endpoint protection at the kernel level, where user-mode security tools have limited visibility or control.

Why This Matters for Defenders

Security tools are often the first signal that a ransomware intrusion is underway. When those tools go dark, defenders lose alerts, forensic trails, and automated containment actions during the critical window before documents, databases, and shared drives are encrypted. That makes detecting the driver’s activity — not just the eventual encryption — the more valuable point of intervention.

Recommended Defensive Steps

Catalyst and other researchers point to several practical measures organizations can take:

• Monitor for unexpected kernel driver installations, especially immediately before security services stop responding
• Watch for suspicious IOCTL requests rather than relying solely on file-based signatures, since tools like this can be renamed or modified
• Keep vulnerable-driver blocklists current and restrict administrative access
• Segment critical systems and retain backups that are isolated from the main network
• Maintain a rehearsed incident response plan so staff can isolate affected devices and preserve evidence quickly

The known indicators of compromise associated with this campaign include the driver files anticheatG13.sys and the related G12drv.sys. As with any active threat intelligence, defenders working with these indicators in SIEM or threat-intel platforms should defang and re-fang IOCs appropriately to avoid accidental resolution.

The Gentlemen case underscores a shift in ransomware tradecraft: increasingly, the fight isn’t just about stopping encryption — it’s about catching attackers in the quieter stage beforehand, when they’re still trying to turn off the lights.