Gentlemen Ransomware Deploys Modular EDR-Killing Framework with Cross-Gang Tools The Gentlemen ransomware operation has adopted a sophisticated, modular approach to evading endpoint detection and response (EDR) systems, leveraging tools sourced from multiple criminal groups. According to an analysis by cybersecurity firm ESET, the gang’s arsenal includes GentleKiller a custom-built EDR killer with at least eight variants alongside borrowed tools like HexKiller, ThrottleBlood, and HavocKiller, previously used by other ransomware gangs. GentleKiller employs the bring your own vulnerable driver (BYOVD) technique, using eight distinct vulnerable drivers to gain kernel-level privileges. Its target list spans over 400 processes across 48 security vendors, including Microsoft, CrowdStrike, SentinelOne, and ESET itself. The tool impersonates legitimate software, such as Kaspersky and Valorant, and uses commercial packers like Enigma and Themida for obfuscation. The modular design allows affiliates to swap drivers without rewriting core code, complicating defenses static blocklists may catch one variant while leaving others operational. Beyond GentleKiller, the gang incorporates tools from rival groups, including HexKiller (linked to Warlock), ThrottleBlood (used by MesudaLocker and DragonForce), and HavocKiller (seen in multiple ransomware campaigns). This tool-sharing creates redundancy, attribution challenges, and tactical flexibility for affiliates. ESET also identified OxideHarvest, a Rust-based credential stealer likely developed externally. The gang’s targeting strategy includes exploiting FortiGate configurations, as seen in the compromise of Romanian energy provider Oltenia. A SystemBC proxy botnet, comprising over 1,570 corporate hosts, provides persistent access for EDR-killer-assisted attacks. The overlap between SystemBC detections and Gentlemen ransomware activity suggests energy-sector defenders should treat such infections as potential indicators of compromise. ESET’s findings highlight the gang’s operational persistence, with 478 victims documented before the modular framework was fully analyzed. The interchangeable nature of the tools combined with stolen digital signatures and rapid driver swaps makes detection and attribution increasingly difficult. Defenders are advised to audit driver blocklists against all eight GentleKiller variants, flag multi-gang EDR killer signatures in incidents, and harden FortiGate configurations to reduce exposure.

Global Law Enforcement Takedown Disrupts Amadey and StealC Malware Operations A coordinated international law enforcement operation, supported by private cybersecurity firms including Bitdefender, Bitsight, ESET, and Microsoft, has dismantled the infrastructure behind the Amadey and StealC malware families. The effort, part of Operation Endgame, targeted cybercriminal "assembly lines" used to deploy ransomware, financial fraud, and attacks on critical infrastructure. Conducted between June 15 and 19, 2026, the operation involved authorities from Belgium, Canada, Denmark, France, Germany, the Netherlands, the U.K., and the U.S. Key outcomes included: - Seizure of 326 servers and 142 domains linked to malware distribution. - Recovery of 27 million stolen login credentials. - Restriction of over $47 million in cryptocurrency assets tied to criminal activity. - Disruption of 15,000 infected WordPress sites used to spread SocGholish malware. ### Amadey: A Persistent Malware Loader Active since October 2018, Amadey operates as a malware-as-a-service (MaaS) loader, sold for $600 per license with an additional $50 per rebuild. Its capabilities include: - Executing commands, downloading payloads, and stealing credentials. - Deploying secondary malware like Lumma Stealer, Vidar Stealer, and RedLine Stealer. - Peaking in activity in 2025, with 11,635 samples distributed up from just 66 in 2019. Amadey’s command-and-control (C2) servers saw a surge in 2023, averaging 5–30 active servers daily, before declining in 2024. The malware avoids execution in Russia, Ukraine, and Belarus by checking system locales. ### StealC: A Versatile Information Stealer First detected in January 2023, StealC is a C++-based stealer sold for $300/month (or $1,000 for six months). It targets: - Browser data (credentials, cookies, autofill entries). - Desktop apps (Discord, Telegram, Steam, Outlook). - Files matching specific naming patterns. Like Amadey, StealC terminates if running in Russia, Ukraine, Belarus, Kazakhstan, or Uzbekistan. A cross-site scripting (XSS) vulnerability in its control panel was patched in February 2026 after being exploited to steal data from affiliates. ### Shared Infrastructure and Global Impact Microsoft reported that Amadey and StealC shared infrastructure, infecting over 140,000 computers worldwide in early May 2026. The company seized control of 18,000 victim devices and shut down 200 malicious C2 domains and IPs. The operation highlights the growing collaboration between public and private sectors to dismantle cybercrime ecosystems, particularly those enabling ransomware and credential theft at scale.

New Modular Malware Framework "Avalon" Unveiled in Sophisticated Phishing Attack Cybersecurity researchers have identified a previously unknown modular malware framework, Avalon, distributed via a multi-stage phishing campaign designed to evade traditional security controls. The framework integrates credential theft, lateral movement, remote access, recovery disruption, and ransomware execution with its ransomware component internally dubbed CrownX. The attack begins with a spoofed legal document email directing recipients to a password-protected archive hosted on Proton Drive. Instead of attaching malicious files directly, attackers embedded them within an ISO image, reducing detection at the email layer. When a victim interacts with a document-themed Windows shortcut (Secure Document CA-283505.pdf.lnk) inside the mounted image, it triggers a sequence that deploys Avalon. The shortcut executes an MSBuild project within the ISO, which loads an embedded .NET assembly to disable Event Tracing for Windows (ETW), obscuring forensic visibility. The malware then downloads a next-stage payload over HTTPS to deploy Avalon, which includes an extensive defense evasion subsystem targeting security tools from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. Avalon’s capabilities include: - Credential harvesting from Chromium-based browsers, Firefox, cryptocurrency wallets (MetaMask, Coinbase Wallet, Exodus, etc.), and apps like Discord, Slack, and Teams. - Data exfiltration to a remote server (helloxcherry[.]com) and command polling for further instructions. - Reconnaissance to prioritize high-value systems for lateral movement. - Ransomware execution using Windows Cryptography API, encrypting files tied to business operations, software development, and virtual infrastructure. - Recovery disruption by terminating the Volume Shadow Copy Service and deleting shadow copies. - Anti-forensic measures, including direct disk manipulation to corrupt partition data or boot records. Researchers note that CrownX represents only the final extortion stage by the time the ransom note appears, the framework has already stolen credentials, established C2 communications, and weakened recovery options. The malware also exhibits signs of AI-assisted development, suggesting lower barriers to entry for threat actors with limited technical expertise. ### AI-Driven Ransomware and Codeless Attacks Emerge In related developments, Sysdig reported the first publicly documented agentic ransomware attack powered by a large language model (LLM). The threat actor, JADEPUFFER, exploited CVE-2025-3248 to gain access to an exposed Langflow instance, executing an automated campaign that adapted in real-time to pivot toward a production database server for extortion. Separately, Palo Alto Networks Unit 42 uncovered an AI-powered malware combining a Telegram bot with a public LLM API (api.groq[.]com) to enable codeless attacks. The malware forwards system details to the attacker’s Telegram bot, then polls the API every five seconds to translate natural language instructions into shell commands eliminating the need for command-line expertise. The sample, uploaded to VirusTotal in March 2026, remains undetected by all engines.

In an alarming security incident, a threat actor known as ToddyCat exploited a critical vulnerability in ESET's cybersecurity solution to deliver covert malware, identified as TCESB, to Windows devices. This breach was enabled by CVE-2024-11859, which allowed attackers to manipulate the library loading process of ESET's command-line scanner. By positioning a malicious version.dll file, the attackers were able to run their malware, thereby evading detection mechanisms. The impact of this incident could extend to various user groups, as the corrupted solution deployed stealth malware that could disrupt systems, potentially leading to data leaks, reputation damage or more severe consequences if the malware affected critical infrastructure or sensitive targets.

In May 2024, significant phishing campaigns targeted SMBs in Central and Eastern European countries like Poland, Romania, and Italy, distributing malware families such as Agent Tesla, Formbook, and Remcos RAT. ESET researchers identified multiple waves of attacks exploiting compromised email accounts and company servers, resulting in over 21,000 users in Poland being impacted. Malicious emails were sent to businesses, with attachments containing ModiLoader for malware delivery. The sophistication of these campaigns indicates an increased cybersecurity threat level for SMBs, with data theft and system compromise as potential outcomes.