Gentlemen Ransomware Uses Lenovo, Safetica Drivers to Kill Security Tools

Acronis Threat Research Unit analysts identified new tactics used by the Gentlemen ransomware group. The actors are leveraging legitimate kernel-mode drivers from Lenovo and Safetica to disable endpoint security software. This activity was observed during a recent incident involving custom malware droppers.

The attackers installed these legitimate drivers as system services to gain privileged access. Once loaded, the malware enumerated running processes on the compromised machine. It then targeted specific security applications for termination. This approach weakens endpoint defenses prior to the encryption phase.

The technique is known as Bring Your Own Vulnerable Driver, or BYOVD. Instead of using standard process termination commands, the group weaponizes trusted software components. The droppers submitted termination requests when process names matched hardcoded security targets. This allows the malware to operate in a less monitored environment.

Technical Details of the Attack

Two specific driver versions were deployed in the observed incident. The samples included Safetica’s ProcessMonitorDriver version 11.26.18 and Lenovo’s BootRepair.sys version 2.5.30.11281. These files were dropped with renamed identifiers to evade initial detection. The filenames included STProcessMonitorNew_clone_03_FC21F904.sys and PhantomKiller_clone_04_94354C0F.sys.

Safetica’s driver contains an input/output control interface that is insufficiently protected. This flaw, tracked as CVE-2025-70795, allows arbitrary process termination. Lenovo’s driver similarly exposes a device interface capable of killing processes. Both rely on unauthenticated IOCTL handlers to execute these commands.

Before deployment, the dropper recovers embedded filenames and paths. It uses an XOR-based deobfuscation routine to transform encoded data. Numerous conditional branches in the code complicate static analysis. However, the underlying operation repeatedly derives keys to reveal the malicious payload.

Actor Background and Methodology

The Gentlemen ransomware group is a Russian-speaking ransomware-as-a-service provider. The operation first emerged under its own brand in mid-2025. According to Acronis researchers, the group reportedly participated in affiliate operations for LockBit and Qilin prior to this launch. This history suggests experienced operators adapting to new defensive measures.

The malware sets its own process priority to the highest level. It uses the ‘SetPriorityClass’ function with value ‘80’ to achieve HIGH_PRIORITY_CLASS status. After loading the driver, the malware compares running process names against its target list. For matches, it passes the process identifier through an IOCTL request.

The driver then invokes ZwOpenProcess and ZwTerminateProcess system calls. These calls move the termination operation into the kernel context. This bypasses user-mode security controls that might otherwise block the action. Acronis emphasized that these findings describe exploitation, not distribution of ransomware by the vendors.

What should you do?

Security teams should monitor for unauthorized installation of kernel drivers. Watch for processes with elevated priority that do not match known applications. Verify the integrity of drivers from vendors like Lenovo and Safetica. Ensure that input/output control handlers are properly authenticated on all systems.

What to do and how to stay safe: Gentlemen Ransomware

• Audit installed kernel drivers to identify any that are not part of the standard OS or approved vendor updates.
• Monitor for processes that use high-priority classes unexpectedly, which may indicate malware attempting to evade detection.
• Check for the presence of specific driver versions mentioned in threat reports, such as Safetica ProcessMonitorDriver 11.26.18.
• Implement strict allow-listing for driver loading to prevent unauthorized kernel-mode code execution on endpoint devices.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE is associated with the Safetica driver vulnerability?

The vulnerability in Safetica’s ProcessMonitorDriver is tracked as CVE-2025-70795.

What ransomware group is using this technique?

The Gentlemen ransomware group, a Russian-speaking RaaS provider, is using this technique.

Did Lenovo or Safetica distribute the ransomware?

No, the findings describe exploitation of vulnerable components, not distribution of ransomware by the vendors.