The Gentlemen operation loads a kernel driver that shuts down antivirus, endpoint detection, and backup agents before any files are locked.

 

What happened

Researchers analyzing the Gentlemen ransomware operation identified a kernel-level driver named anticheatG13.sys that terminates close to 180 security-related processes ahead of file encryption, Cyber Security News reported on July 31, 2026. A kernel driver runs at the deepest privilege level in Windows, below the security software it targets, which is what allows it to shut those tools down rather than merely hide from them. The processes on its list include antivirus, endpoint detection and response agents, backup software, and monitoring tools. The driver expands on capabilities found in an earlier component the same researchers tracked as G12drv.sys. The initial access method was not detailed in the analysis, which examined activity after the attackers already had a foothold.

 

Going deeper

Process termination is only part of what the driver does. It carries functions for system enumeration, file-operation control, minifilter management, and direct modification of kernel memory, according to the analysis. It also supports Windows Filtering Platform connection redirection and address allowlisting, which give an attacker control over what network traffic reaches where, including whether a security agent can still phone home. Command-line rewriting lets it alter what gets recorded about the commands being run. Beyond killing processes outright, it supports destructive operations against process memory, which can disrupt an application even when a clean termination fails, and it can inspect driver loads and block selected drivers from starting. What that combination produces is a machine where the tools meant to generate the first alert are gone, the network path they would have used is controlled, and the record of what happened has been rewritten.

 

What was said

In this class of attack, "An adversary delivers and installs a vulnerable driver onto the target system" and then exploits it to execute code in kernel mode, CISA writes in its countermeasure guidance on the technique known as Bring Your Own Vulnerable Driver. The agency notes that Windows Driver Signature Enforcement means only signed kernel drivers can load, which is why attackers reach for legitimate signed drivers carrying known flaws rather than writing unsigned ones.

 

In the know

The Microsoft Vulnerable Driver Blocklist is native to Windows 11 2022 and later and receives updates once or twice a year, but it only takes effect when Hypervisor-protected Code Integrity, Smart App Control, or S mode is active, CISA notes. Devices that cannot run those protections gain nothing from it by default. For those, Microsoft publishes a recommended block list that administrators can add to a Windows Defender Application Control policy, and CISA advises testing the policy in audit mode first and reviewing the resulting block events before enforcing it. The detection signal worth building an alert around is narrow and specific, since an unexpected driver installation followed shortly by security services stopping or going unresponsive is a sequence with few innocent explanations.

 

The big picture

The devices least able to run these protections are often the ones healthcare organizations can least afford to lose. Clinical workstations tied to imaging equipment, laboratory instruments, and older medical devices frequently run legacy drivers that break under memory integrity enforcement, which leaves them outside the blocklist's coverage while sitting on the same network as everything else. Backup agents appearing on the termination list deserve separate attention, since an attack that disables backup software before encrypting removes the option that makes refusing a ransom viable. The #StopRansomware Guide from CISA and the FBI puts offline, encrypted, and immutable backups at the center of its recommendations for that reason, along with network segmentation that limits how far a compromised host can reach. Defense that begins when encryption starts has already lost the part of the timeline where intervention was possible.

 

FAQs

What is the difference between a malicious driver and a vulnerable one?

A vulnerable driver is legitimate, signed software containing a flaw an attacker exploits to run their own code in the kernel. A malicious driver is written by the attacker and must be signed, often through stolen or fraudulently obtained certificates, before Windows will load it. Both routes end with kernel-level access.

 

Why can kernel-level code disable security software that runs as protected?

Windows offers Protected Process Light status, which prevents ordinary programs from tampering with security processes, but that protection is enforced by the kernel itself. Code running in kernel mode operates at the same level as the enforcement mechanism and can modify the structures it depends on.

 

How would a security team notice the blocklist is not being enforced?

Check whether memory integrity is enabled under Core Isolation in Windows Security, since the blocklist toggle appears greyed out and active when it is. Fleet-wide, the answer comes from endpoint management reporting on HVCI status, which typically reveals a substantial population of exempted machines.

 

What are IOCTL requests and why do they matter for detection?

Input and output control codes are the messages a user-mode program sends to instruct a driver to act. Monitoring which processes send them and to which drivers catches abuse even when the driver file has been renamed or modified, which defeats detection based on file hashes alone.

 

Does an attack like this change breach notification obligations?

Not by itself, since obligations turn on whether protected health information was accessed or acquired rather than on the technique used. The disabled logging does complicate the risk assessment, because an organization that cannot reconstruct what the attacker reached will struggle to demonstrate a low probability of compromise.