The Gentlemen ransomware, run by GOLD SHERWOOD, encrypts networks in under 24 hours. See the affiliate playbook and how to defend against it.

Related Posts:

• PHP Web Server Rootkit Targets F5 BIG-IP Devices
• StreamRat Banking Trojan Targets Spanish Android Users
• Silver Fox Fake Software Installers Disable Windows Defender

The post The Gentlemen Ransomware Deploys in Under 24 Hours appeared first on Daily CyberSecurity.

A Cambodia malware campaign hides SparkRAT in PNG files and abuses a vulnerable driver to kill antivirus, Acronis TRU reports.

Related Posts:

• Dark Caracal Deploys New GoCaracal Malware Framework
• BREEZE COMET Threat Actor Attacks Brazilian Banks
• AnonyMousKIT Uses AI Voice Calls to Unlock Stolen iPhones

The post Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT appeared first on Daily CyberSecurity.

Cisco Talos reveals that Chinese-speaking threat group UAT-10147 deploys the SPECTRE cross-platform implant with Linux rootkits and BYOVD capabilities.

Related Posts:

• ValleyRAT Backdoor Spread via Signed Chinese Adware
• Kimsuky Spear Phishing Abuses Remote Control Tools
• Fire Ant Threat Actor Targets Trusted Infrastructure

The post UAT-10147 Deploys SPECTRE Cross-Platform Implant appeared first on Daily CyberSecurity.

eSentire ties the Cruciferra malware loader to ClickFix EDR killer attacks that abuse a signed driver to stop 145 security processes.

Related Posts:

• WeedHack Malware Still Hits Minecraft Gamers via Fake Sites
• 77 Malicious Firefox Extensions Steal Crypto Wallet Secrets and Credentials
• Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign

The post Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR appeared first on Daily CyberSecurity.

GodDamn ransomware uses the signed PoisonX driver to disable security tools, marking a more advanced version of the Beast ransomware family.

Symantec’s Threat Hunter Team found a new ransomware family called GodDamn that first appeared in the wild on May 21, 2026, and analyzed an attack that took place in early June. The group behind it, which Symantec tracks as Hyadina, has been running ransomware operations since March 2022. GodDamn is their third product: Monster came first, Beast followed in June 2024, and now this.

The lineage isn’t speculation. Symantec researchers noticed significant code overlap between GodDamn and Beast, and the operational toolset, including AnyDesk for remote access, NirSoft-based credential stealers, and the same avoidance of targets in CIS countries, runs consistently across all three iterations.

“Analysis of a recent GodDamn ransomware attack indicates that this seemingly new ransomware is in fact the latest rebrand of the Beast ransomware, which in itself was a rebrand of the Monster ransomware, which was first seen in 2022.” reads the report published by Symantec. “The Symantec Threat Hunter Team tracks the developer behind these ransomware families as Hyadina.”

The headline upgrade in GodDamn is the use of PoisonX, a kernel driver that carries a valid Microsoft signature. That signature matters because Windows loads signed drivers automatically, and a driver running at kernel level can terminate security software processes, strip away the permissions those tools need to function, or tamper with the kernel’s internal event notifications so that security products stop receiving alerts about what’s happening on the machine. They keep running, but they’re effectively blind.

Most bring-your-own-vulnerable-driver (BYOVD) attacks exploit a legitimate but flawed driver that already exists. PoisonX is different.

The cybersecurity community first observed the use of the PoisonX kernel driver in early 2026 when attackers used it to disable security software. At the time, threat actors used it to kill the CrowdStrike Falcon service by sending a crafted IOCTL to the driver’s undocumented interface.

“The driver is signed by Microsoft and so to the system it appears to be a legitimate driver. This means it can be used to stop or disable security software at the kernel level. We commonly call this type of defense evasion a bring-your-own-vulnerable-driver (BYOVD) attack, where a vulnerability in a legitimate driver is exploited to shut down defenses.” continues the report. “However, the PoisonX driver seems to be slightly more unusual, in that it appears to be a malicious driver that its developers succeeded in getting signed by Microsoft, and it is now being used by ransomware attackers.”

Now PoisonX is part of GodDamn’s standard toolkit, and it’s also been adopted by the operators of The Gentlemen ransomware-as-a-service scheme in their custom defense-disabling tool handed to affiliates.

The initial access vector for the investigated attack is unknown. The first confirmed malicious activity appeared on May 29, when AnyDesk turned up on a host inside the organization, placed in the user’s Music folder rather than a standard installation directory. That location is consistent with manual delivery by an attacker who’d already obtained access through some earlier means.

The next day, the attackers deployed their defense evasion capabilities on a second host.

A file named symantec.exe, staged in the Music folder and designed to look like a Symantec product, dropped the PoisonX driver into the system driver store as g11.sys. On the same host, a credential-harvesting toolkit appeared in a subdirectory of the user profile containing 14 separate tools: Mimikatz, WebBrowserPassView, ChromePass, PasswordFox, MessengerPass, VNCPassView, MailPassView, SniffPass, OperaPassView, CredentialsFileView, WirelessKeyView, ExtPassword, PSTPassword, and NetPass. Together they cover browsers, Windows Credential Manager, cached domain credentials, VNC sessions, email clients, Wi-Fi profiles, and live network traffic. Netscan.exe was included to map reachable hosts. That’s a thorough shopping list.

After a two-day gap, lateral movement began on June 1 using PsExec, with all commands sharing a process chain through psexesvc.exe, services.exe, and wininit.exe. The attackers disabled Windows Defender real-time monitoring and mounted administrative shares using stolen credentials to reach adjacent systems.

“There was then a gap in activity by the attackers of approximately two days. On June 1, 2026, lateral movement began across the enterprise network.” states Symantec. “All malicious commands during this phase shared a process lineage running through psexesvc.exe, services.exe, and wininit.exe, confirming that PsExec was being used to push commands to remote targets. “

On each host they reached, they configured AnyDesk for unattended access: a dedicated configuration directory was created, the interactive consent prompt was suppressed, and a remote access password was set by piping it directly to AnyDesk’s standard input.

AnyDesk was then registered as two separate auto-start Windows services to survive reboots, with a PowerShell pre-staged installer used on some machines to streamline the rollout.

“After completing the AnyDesk setup on each host, the attackers terminated the running AnyDesk process, waited briefly, then rebooted the machine.” continues the report. “By the end of June 2, this deployment sequence had been repeated across at least 10 hosts within the targeted organization.”

The four-day gap between the first activity on May 29 and encryption starting June 3 is consistent with a dwell period used for staging, data exfiltration, or further reconnaissance.

GodDamn ransomware was first detected on June 3 on a separate network segment belonging to a distinct part of the organization. The binary was named encrypter-windows-gui-x86.exe and appeared in user Downloads and Music folders. In some attacks, encrypted files are renamed with the .God8Damn extension. In this particular incident, the attackers used the victim organization’s own name as the file extension, which Symantec describes as somewhat unusual. Victims are directed to contact the attackers via email or the qTox encrypted messaging app.

Let’s look at the threat actor behind the new ransomware family. Hyadina’s track record since 2022 shows a consistent pattern: take what worked before, fix the detection problems, add new capabilities, rebrand. Monster used Delphi and targeted 32-bit Windows. Beast added Linux and VMware ESXi support, expanded language options including Chinese, and improved encryption performance. GodDamn adds a legitimately signed malicious kernel driver.

As Symantec observed about the original Monster attacks: “One of the hallmarks of a November 2022 Monster attack documented by Symantec was the use by the attackers of a password protected self-extracting archive containing the Mimikatz credential-dumping tool and a large number of password-harvesting tools developed by NirSoft, much like the tools we saw used in this recent GodDamn attack, with many of the same tools used, including AnyDesk and NetScan also.”

The toolset hasn’t changed much in four years. The evasion techniques have.

“GodDamn appears to be the latest ransomware iteration from this group, which continues to develop its stealth and defense evasion capabilities. GodDamn’s use of the relatively newly discovered PoisonX malicious driver component represents an escalation in defensive evasion capability by this group, indicating that Hyadina is continuing to actively develop its ransomware and its capabilities.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, GodDamn Ransomware)

The Gentlemen equips affiliates with a centralized EDR-killer suite, rapidly weaponizing BYOVD exploits to disable security tools before ransomware attacks.

ESET published a detailed breakdown of The Gentlemen‘s technical infrastructure on June 18, the result of months of incident-level investigation corroborated by the group’s own internal data leak from May 2026. Since emerging in late 2025, The Gentlemen has claimed 504 victims and established itself as one of the five most active ransomware operations in Q1 2026. What sets them apart isn’t the ransomware payload. It’s what they hand to affiliates before the payload ever runs.

Most ransomware-as-a-service operators leave affiliates to find their own tools for disabling endpoint security. The Gentlemen took a different approach.

“Gentlemen demonstrates an interesting approach: operator-managed EDR killers, ready to use by affiliates.” reads the report published by ESET. “While most ransomware gangs continue to delegate EDR killing to affiliates, Gentlemen has chosen to centralize this function by offering affiliates a ready-to-use, standardized EDR-killer suite. This decision makes Gentlemen an attractive operator for affiliates as it materially lowers the entry barrier for them, making their job consequently easier.”

The leaked internal data confirmed what ESET had hypothesized since February 2026: the group’s leader, operating under the handle zeta88, openly discussed maintaining and distributing EDR killer packages to affiliates.

The centerpiece of that suite is GentleKiller, an in-house framework with at least eight distinct variants. Each one impersonates a different legitimate product and abuses a different vulnerable or malicious kernel driver through a technique called Bring Your Own Vulnerable Driver, or BYOVD.

“GentleKiller is by far the most prevalent EDR killer observed in the Gentlemen ecosystem. At the time of writing, we are aware of at least eight distinct variants, each impersonating a different legitimate product and abusing a different vulnerable or malicious driver.” states ESET.

“When abstracting away the impersonation layer and the specific drivers used, the underlying code reveals numerous structural and behavioral commonalities that strongly suggest the use of a shared development template. This template is reused across variants, with only minimal modifications.”

The eight variants target drivers from Kaspersky, FACEIT Anti-Cheat, Valorant, Javelin, Safetica, Zemana, Qihoo 360, IObit, and the PoisonX rootkit. Across all variants, GentleKiller hunts for over 400 processes belonging to 48 distinct security products, including CrowdStrike, SentinelOne, Microsoft Defender, Sophos, Carbon Black, and ESET itself.

The researchers pointed out that the speed of adaptation is the other defining characteristic.

“This design prioritizes ease of deployment and operational flexibility for affiliates, while minimizing development effort for the operators.” continues the reèprt- “It allows the Gentlemen operators to integrate abused drivers into their toolset very soon after an EDR killer PoC is disclosed. This was the case with UnknownKiller and PoisonKiller, which were adopted within a matter of days.”

ESET measured this in days. The UnknownKiller and PoisonKiller proof-of-concepts were both adopted within days of their public release.

Beyond GentleKiller, the suite incorporates three third-party tools. HexKiller, previously associated exclusively with the Warlock ransomware gang, uses a Baidu Antivirus driver and appeared in Gentlemen intrusions staged in the same GentlemenCollection directory as GentleKiller. ThrottleBlood, more commonly seen in MedusaLocker and DragonForce affiliate attacks, uses a TechPowerUp driver. HavocKiller, disclosed publicly by Huntress in March 2026, was already active in Gentlemen intrusions dating back to January 23rd. ESET’s assessment is that all three were acquired externally by the operators and then standardized with the same defense evasion layer applied to GentleKiller: binary protection via Enigma or Themida, filenames mimicking security vendors, fabricated version information, copied digital signatures, and matching icons.

The victimology breaks a pattern that defines most major ransomware operations. Where Qilin, DragonForce, and Akira all show heavy US concentration, often around half their victims, The Gentlemen’s list skews toward Southeast Asia, South America, and Western Europe. The leaked data suggests this isn’t random: the group selects victims primarily based on FortiGate misconfiguration rather than geography, and centrally distributes targets to affiliates. That’s a structured selection process rather than affiliates each picking their own prey.

ESET also found a Rust-based credential stealer called OxideHarvest, also tracked as buildx641, linked to one of the group’s affiliates. It targets Chrome, Edge, Firefox, Brave, Opera, OperaGX, Vivaldi, Waterfox, and a dozen other browsers, using supplied credentials to log into specified hosts, pull browser credentials, and write them to an output file. Unlike GentleKiller, which shows clear evidence of in-house development, OxideHarvest is attributed to an affiliate named quant rather than the core operators.

Brian Krebs published evidence on June 10 of the true identity of hastalamuerte, the group’s founder, identified as 36-year-old Russian national Alexander Andreevich Yapaev, a former affiliate of Qilin, Embargo, LockBit, Medusa, and BlackLock.

“The breach tracking service Constella Intelligence reports that Hastalamuerte’s Telegram ID is connected to another username — “bu4vs” — and to the Russian phone number 79127650004.” wrote Krebs. “Pivoting on this phone number in Constella fetches multiple records from hacked Russian government databases showing it is assigned to one Alexander Andreevich Yapaev, a 36-year-old from Izhevsk.”

According to the report, The Gentlemen rapidly weaponizes newly disclosed BYOVD proof-of-concepts, often incorporating vulnerable driver exploits into operations within days of public release.

For defenders, the ESET report’s practical implication is this: GentleKiller’s process targeting list is now public, which means defenders can use it to design monitoring and detection strategies that remain effective even against variants that haven’t been built yet.

“Gentlemen demonstrates an interesting approach: operator-managed EDR killers, ready to use by affiliates. While most ransomware gangs continue to delegate EDR killing to affiliates, Gentlemen has chosen to centralize this function by offering affiliates a ready-to-use, standardized EDR-killer suite.” concludes the report. “This decision makes Gentlemen an attractive operator for affiliates as it materially lowers the entry barrier for them, making their job consequently easier.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, The Gentlemen)

DragonForce hid for months by routing malware traffic through Microsoft Teams infrastructure, masking C2 activity and evading network detection.

DragonForce ransomware operators hit a major U.S. services firm and stayed hidden for one to two months by routing their command-and-control traffic through Microsoft’s own Teams relay servers. Symantec’s threat hunters tracked the custom backdoor they used as Backdoor.Turn. To any defender watching the network, the traffic looked like normal Teams activity.

“Backdoor.Turn obtains an anonymous Teams visitor token from Microsoft’s Skype-backed identity services, uses a legitimate Microsoft TURN relay to set up the connection, and then runs a QUIC session to the attacker’s real command-and-control server.” reads the report published by Symantec. “To our knowledge this is the first time TURN relay infrastructure has been abused this way in the wild. It is relatively unusual to see ransomware attackers using their own custom tools, and it is particularly unusual to see them using a custom tool as sophisticated as Backdoor.Turn.

This is the first known malware to abuse TURN relay infrastructure this way. The technique was inspired by the Ghost Calls method presented at Black Hat in 2025, which focused on C&C communication that’s hard to profile from the network side.

The backdoor is written in Go and injected into the legitimate DbgView64.exe process. The malicious payload can execute commands, scan networks, map Active Directory, move laterally with stolen credentials, and pull passwords from browsers.

The attackers got in through what appears to be a vulnerability in an SQL or MSSQL server, though the exact flaw is still unknown. They may have bought access from a broker. Once inside, starting December 2025, they dropped a .zip archive containing a legitimate VirtualBox executable paired with a malicious DLL designed to sideload and fetch additional payloads from remote servers.

For defense evasion, they used the Bring Your Own Vulnerable Driver (BYOVD) technique against multiple signed drivers, including a novel attack on Huawei’s HWAuidoOs2Ec.sys. That driver’s vulnerable status had been documented by Huntress in March 2026, after this attack already happened.

“This driver wasn’t known to be exploited like this in the wild prior to this attack, though its vulnerable status was documented by researchers at Huntress in March 2026, after this attack happened.” states the report.

They also deployed a custom-built malicious driver disguised as a legitimate Palo Alto driver, which doesn’t even fit the standard BYOVD definition since it wasn’t a legitimate driver to begin with.

DragonForce has been active since at least June 2023 and has since moved from a standard ransomware-as-a-service model to a cartel structure. Backdoor.Turn gets installed after the ransomware runs, which suggests the group is either maintaining persistence for a follow-up intrusion or selling access to other attackers.

“The attackers in this campaign use exceptionally sophisticated cyber tradecraft. The configuration of Backdoor.Turn means that security products only see C&C traffic going to legitimate Teams servers, leaving defenders unaware that data is being siphoned away by malicious actors.” concludes the report. “The exploitation of a driver that was not at the time known to be vulnerable (Havoc Process Terminator) also demonstrates a strong level of expertise and sophistication on behalf of the attackers.”

DragonForce has been active since at least 2023. The cybercrime group has evolved from a traditional ransomware-as-a-service operation into a structured cybercrime cartel. According to Symantec, the group has steadily expanded its capabilities, adopting advanced techniques such as the Backdoor.Turn malware and sophisticated BYOVD evasion methods. Its growing operational maturity, resources, and focus on targeted attacks position DragonForce among today’s most capable and persistent ransomware threats. (315 characters)

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)