Gentlemen Ransomware Deploys Modular EDR-Killing Framework with Cross-Gang Tools The Gentlemen ransomware operation has adopted a sophisticated, modular approach to evading endpoint detection and response (EDR) systems, leveraging tools sourced from multiple criminal groups. According to an analysis by cybersecurity firm ESET, the gang’s arsenal includes GentleKiller a custom-built EDR killer with at least eight variants alongside borrowed tools like HexKiller, ThrottleBlood, and HavocKiller, previously used by other ransomware gangs. GentleKiller employs the bring your own vulnerable driver (BYOVD) technique, using eight distinct vulnerable drivers to gain kernel-level privileges. Its target list spans over 400 processes across 48 security vendors, including Microsoft, CrowdStrike, SentinelOne, and ESET itself. The tool impersonates legitimate software, such as Kaspersky and Valorant, and uses commercial packers like Enigma and Themida for obfuscation. The modular design allows affiliates to swap drivers without rewriting core code, complicating defenses static blocklists may catch one variant while leaving others operational. Beyond GentleKiller, the gang incorporates tools from rival groups, including HexKiller (linked to Warlock), ThrottleBlood (used by MesudaLocker and DragonForce), and HavocKiller (seen in multiple ransomware campaigns). This tool-sharing creates redundancy, attribution challenges, and tactical flexibility for affiliates. ESET also identified OxideHarvest, a Rust-based credential stealer likely developed externally. The gang’s targeting strategy includes exploiting FortiGate configurations, as seen in the compromise of Romanian energy provider Oltenia. A SystemBC proxy botnet, comprising over 1,570 corporate hosts, provides persistent access for EDR-killer-assisted attacks. The overlap between SystemBC detections and Gentlemen ransomware activity suggests energy-sector defenders should treat such infections as potential indicators of compromise. ESET’s findings highlight the gang’s operational persistence, with 478 victims documented before the modular framework was fully analyzed. The interchangeable nature of the tools combined with stolen digital signatures and rapid driver swaps makes detection and attribution increasingly difficult. Defenders are advised to audit driver blocklists against all eight GentleKiller variants, flag multi-gang EDR killer signatures in incidents, and harden FortiGate configurations to reduce exposure.

New Modular Malware Framework "Avalon" Unveiled in Sophisticated Phishing Attack Cybersecurity researchers have identified a previously unknown modular malware framework, Avalon, distributed via a multi-stage phishing campaign designed to evade traditional security controls. The framework integrates credential theft, lateral movement, remote access, recovery disruption, and ransomware execution with its ransomware component internally dubbed CrownX. The attack begins with a spoofed legal document email directing recipients to a password-protected archive hosted on Proton Drive. Instead of attaching malicious files directly, attackers embedded them within an ISO image, reducing detection at the email layer. When a victim interacts with a document-themed Windows shortcut (Secure Document CA-283505.pdf.lnk) inside the mounted image, it triggers a sequence that deploys Avalon. The shortcut executes an MSBuild project within the ISO, which loads an embedded .NET assembly to disable Event Tracing for Windows (ETW), obscuring forensic visibility. The malware then downloads a next-stage payload over HTTPS to deploy Avalon, which includes an extensive defense evasion subsystem targeting security tools from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. Avalon’s capabilities include: - Credential harvesting from Chromium-based browsers, Firefox, cryptocurrency wallets (MetaMask, Coinbase Wallet, Exodus, etc.), and apps like Discord, Slack, and Teams. - Data exfiltration to a remote server (helloxcherry[.]com) and command polling for further instructions. - Reconnaissance to prioritize high-value systems for lateral movement. - Ransomware execution using Windows Cryptography API, encrypting files tied to business operations, software development, and virtual infrastructure. - Recovery disruption by terminating the Volume Shadow Copy Service and deleting shadow copies. - Anti-forensic measures, including direct disk manipulation to corrupt partition data or boot records. Researchers note that CrownX represents only the final extortion stage by the time the ransom note appears, the framework has already stolen credentials, established C2 communications, and weakened recovery options. The malware also exhibits signs of AI-assisted development, suggesting lower barriers to entry for threat actors with limited technical expertise. ### AI-Driven Ransomware and Codeless Attacks Emerge In related developments, Sysdig reported the first publicly documented agentic ransomware attack powered by a large language model (LLM). The threat actor, JADEPUFFER, exploited CVE-2025-3248 to gain access to an exposed Langflow instance, executing an automated campaign that adapted in real-time to pivot toward a production database server for extortion. Separately, Palo Alto Networks Unit 42 uncovered an AI-powered malware combining a Telegram bot with a public LLM API (api.groq[.]com) to enable codeless attacks. The malware forwards system details to the attacker’s Telegram bot, then polls the API every five seconds to translate natural language instructions into shell commands eliminating the need for command-line expertise. The sample, uploaded to VirusTotal in March 2026, remains undetected by all engines.

Cephalus Ransomware: A Rising Threat Exploiting RDP Vulnerabilities Since mid-2025, the Cephalus ransomware has emerged as a sophisticated threat, targeting Windows systems through unsecured Remote Desktop Protocol (RDP) access. Written in Go, this malware employs double extortion, stealing and encrypting data before demanding payment. Attackers exploit stolen RDP credentials often due to the absence of multi-factor authentication (MFA) to gain initial access. Once inside, they exfiltrate data via MEGA cloud storage and deploy the ransomware using DLL sideloading, leveraging the legitimate SentinelOne executable SentinelBrowserNativeHost.exe to load malicious components (SentinelAgentCore.dll and data.bin). Cephalus uses hybrid encryption, combining AES-256-CTR for file encryption and RSA-1024 to secure the AES key. To evade analysis, it generates fake AES keys (e.g., "FAKE_AES_KEY_FOR_CONFUSION_ONLY!") and employs secure memory handling techniques like VirtualLock and XOR masking to avoid detection in memory dumps. ### Attack Chain & Evasion Tactics The ransomware follows a structured kill chain, including: - Execution & Persistence: Code injection via VirtualAlloc and VirtualProtect, alongside scheduled tasks for reboot survival. - Discovery: Gathering system intel using APIs like GetSystemInfo, RtlGetVersion, and Toolhelp32Snapshot to tailor attacks and evade sandboxes. - Defense Evasion: Disabling Windows Defender via PowerShell commands, registry edits (DisableRealtimeMonitoring, DisableAntiSpyware), and stopping security services (WinDefend, Sense). - Impact: Deleting Volume Shadow Copies, enumerating network drives, and encrypting files with the .sss extension. Ransom notes (recover.txt) include proof-of-theft links to GoFile.io and references to past victims for added pressure. ### Defensive Measures & Emulation Security firm AttackIQ released a 2026 emulation graph replicating Cephalus’s Tactics, Techniques, and Procedures (TTPs), based on reports from Huntress (August 2025) and AhnLab (December 2025). The emulation tests controls across execution, evasion, discovery, and impact, helping organizations validate detections against opportunistic ransomware. Key indicators of compromise (IOCs) include: - SHA256: a34acd47127196ab867d572c2c6cf2fcccffa3a7a87e82d338a8efed898ca722 - File extension: .sss - Suspicious activity: PowerShell/reg.exe commands, DLL sideloading in Downloads folders To mitigate risks, security teams are advised to enforce MFA on RDP, monitor DLL sideloading, block MEGA cloud abuse, and harden Windows Defender via group policies. As Cephalus evolves, continuous validation remains critical to maintaining resilience against such threats.

SentinelOne, an American endpoint protection solutions provider, was targeted in a supply chain attack by Chinese hackers. The attack involved exploiting vulnerabilities in network devices and using malware to gain access to the company's systems. The hackers aimed to compromise SentinelOne's infrastructure to access downstream corporate networks and develop evasion methods. Despite the attempts, SentinelOne reported no compromise of its software or hardware.

Brazilian Banking Malware "KREMLIN" Leverages Blockchain for Stealthy Operations Cybersecurity researchers at Elastic Security Labs have uncovered a previously undocumented Brazilian banking malware campaign, tracked as REF9334, deploying a sophisticated toolkit called KREMLIN. Active since at least May 2025, the threat actor targets users through phishing lures impersonating 12 Brazilian banks, tricking victims into installing a malicious browser extension on Google Chrome and Microsoft Edge. The KREMLIN malware ecosystem employs a multi-stage infection chain, including JavaScript loaders, custom C++ installers, and malicious browser extensions, to steal credentials, session tokens, and sensitive data. A key tactic involves bypassing Chromium’s integrity mechanisms by manipulating Secure Preferences and regenerating HMACs and App-Bound encrypted hashes, allowing the extension to evade detection. A defining feature of the operation is its use of blockchain-based infrastructure. The threat actors leverage Ethereum smart contracts as dead drop resolvers, dynamically updating command-and-control (C2) endpoints and payload hosting locations to avoid disruption. This technique was adopted on May 19, 2026, marking a shift in the group’s evasion strategies. ### Infection Chain & Evasion Tactics The attack begins with a JavaScript file disguised as a banking document, invoice, or corporate file, manually executed by the victim. The malware then deploys a multi-stage loader, which first checks for sandbox or virtual machine environments before proceeding. If the system passes these checks, the loader establishes persistence via a scheduled task and retrieves payload locations from an Ethereum smart contract. The second stage downloads and executes three key components: - A malicious browser extension installer - A .NET PE Injector - "SentinelMemoryScanner.exe" (a legitimate SentinelOne binary abused for DLL sideloading) The C++ installer sideloads an unsigned DLL ("SentinelAgentCore.dll") that performs additional evasion checks, including scanning for hard-coded process names and verifying hardware properties (e.g., requiring ≥2 CPUs and >3GB RAM). If these conditions aren’t met, the malware terminates. ### Malicious Browser Extension: "AVSync System Inc." The malware fetches two C2 domains (volmira[.]site and zaviro[.]online) from the Ethereum smart contract, then queries the first to obtain the latest extension version ("1.0.0") and ID ("ndpbidppejfanjbhfgjlohfanbfbklff"). The extension, named "AVSync System Inc.", is installed only if no prior version exists or if an update is detected. To bypass Secure Preferences protection, KREMLIN uses a publicly documented technique (Phantom Extension/GhostChrome-X), modifying the Secure Preferences file and enabling Chrome’s developer mode to register the extension without triggering security alerts. This method was also observed in a 2026 APT31 campaign exploiting Chrome and Windows zero-days. Once installed, the extension harvests and exfiltrates browser data including cookies, sessionStorage, localStorage, and tab history to its C2 server (luizestrelhashapr[.]online:443). It also generates a unique victim identifier stored in the browser and supports multiple commands via WebSocket and disguised CSS requests, such as: - Screenshot capture of active tabs - Tab enumeration and domain tracking - Cookie and storage theft - HTML source extraction - Dynamic configuration updates ### Campaign Scope & Impact Elastic Security Labs attributes seven distinct campaigns to this threat actor since June 16, 2025, with infections primarily targeting Brazilian users. The malware also distributes off-the-shelf Trojans like Pulsar RAT and Remcos RAT. To evade analysis, KREMLIN employs a network canary check, attempting to download a page from an unregistered domain. If a response is received (indicating a sandbox), the malware deliberately crashes. Elastic registered the canary domain, identifying 1,515 infected systems, with over 98% located in Brazil. While the registration temporarily disrupted the campaign’s C2 infrastructure, infected systems remain at risk, requiring remediation efforts to neutralize the threat.

OrBit Linux Rootkit Evolves Over Four Years, Becomes Shared Tool for Cyber Threats A stealthy Linux rootkit known as OrBit has been actively abused by threat actors for over four years, evolving from a custom-built tool into a widely adopted malware framework. Initially documented in 2022, OrBit was later revealed to be a repackaged version of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in late 2022. Rather than developing new malware, attackers have modified and redeployed this publicly available codebase with varying configurations, credentials, and evasion techniques. ### How OrBit Operates OrBit functions as a userland rootkit, hijacking the system’s dynamic linker (ld.so) to inject a malicious shared library into every running process. This allows it to: - Intercept authentication flows by hooking into Pluggable Authentication Modules (PAM), capturing SSH and sudo credentials. - Store stolen credentials in hidden directories (e.g., `/lib/libseconf/`). - Hide its presence by manipulating over 40 libc functions, masking files, processes, and network connections from administrators. Unlike traditional malware, OrBit operates as a passive implant, avoiding direct command-and-control (C2) communication. Instead, attackers access compromised systems via a hidden SSH backdoor. ### Evolution and Variants Researchers have identified two primary variants of OrBit: 1. Lineage A – A full-featured version with credential harvesting, network hiding, packet capture, and backdoor access. 2. Lineage B – A lighter variant with reduced functionality, likely designed to minimize detection. Over time, attackers have rotated credentials, adjusted installation paths, and introduced compatibility fixes (e.g., a custom `xread` function to prevent system instability). Key developments include: - 2025: Introduction of audit log evasion and an advanced PAM hook capable of manipulating authentication outcomes. - 2025: Shift to a multi-stage infection chain, including a dropper and infector that spreads via cron jobs and downloads payloads from remote domains a first for OrBit. - 2026: Continued refinement, with infrastructure overlaps observed with the RHOMBUS botnet. ### Widespread Adoption by Threat Actors OrBit is no longer tied to a single group. Multiple threat actors have deployed it, including: - BLOCKADE SPIDER (ransomware-linked) - UNC3886 (state-backed espionage group) This adoption highlights a broader trend: Linux environments, including critical infrastructure and virtualized systems, are increasingly targeted by shared malware toolkits. ### Detection and Indicators of Compromise (IOCs) Despite superficial changes (e.g., file paths, passwords), OrBit’s core behaviors remain consistent. Defenders are advised to monitor for: - Hidden filesystem artifacts (e.g., `/lib/libseconf/`). - Credential harvesting activity via PAM hooks. - Known hashes (see partial list below). #### Sample IOCs (SHA-256) | Hash | Year | Role | Lineage | |------|------|------|---------| | `40b5127c8cf9d6bec4dbeb61ba766a95c7b2d0cafafcb82ede5a3a679a3e3020` | 2022 | Payload | A | | `3ba6c174a72e4bf5a10c8aaadab2c4b98702ee2308438e94a5512b69df998d5a` | 2023 | Payload | B | | `a61386384173b352e3bd90dcef4c7268a73cd29f6ae343c15b92070b1354a349` | 2024 | Payload | A | | `04c06be0f65d3ead95f3d3dd26fe150270ac8b58890e35515f9317fc7c7723c9` | 2025 | Infector | | | `d7b487d2e840c4546661f497af0195614fc0906c03d187dc39815c811ea5ec3f` | 2026 | Payload | A | OrBit’s persistence and adaptability underscore the growing sophistication of Linux-targeted threats, with attackers leveraging open-source tools to evade detection and maintain long-term access.

Cybercriminals Weaponize Legitimate Windows Driver to Disable Security Tools in Large-Scale Attacks A sophisticated cyberattack campaign is exploiting a trusted Windows kernel driver truesight.sys, part of Adlice Software’s RogueKiller antivirus to disable endpoint detection and response (EDR) and antivirus solutions before deploying ransomware or remote access malware. The attack leverages over 2,500 validly signed variants of the vulnerable driver, bypassing Microsoft’s security controls by abusing legacy driver signing rules. Originally exposed by Check Point researchers, the technique allows threat actors to load pre-2015 signed drivers on modern Windows 11 systems, granting them kernel-level privileges to terminate security processes undetected. MagicSword analysts later confirmed the method’s rapid adoption by multiple threat groups, including financially motivated actors and advanced persistent threat (APT) groups. The driver’s IOCTL command enables attackers to forcibly kill nearly 200 security products, from CrowdStrike and SentinelOne to Kaspersky and Symantec, leaving systems exposed to ransomware like HiddenGh0st or other payloads. The infection chain typically begins with phishing emails, fake download sites, or compromised Telegram channels, tricking users into running a disguised installer. The malware then establishes persistence via scheduled tasks and DLL side-loading, deploys an obfuscated EDR killer module, and installs the TrueSight driver as a Windows service (often named TCLService). With security tools neutralized at the kernel level, the final payload executes with minimal resistance sometimes within 30 minutes of initial compromise. The attack’s high evasion rate and reliance on signature-based defenses make it particularly dangerous for enterprises, as victims often only detect the breach after encryption or data exfiltration has occurred. The campaign’s scale and effectiveness highlight the growing threat of legitimate driver abuse in modern cyberattacks.