Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Gentlemen EDR Killer Suite Combines HexKiller, ThrottleBlood, and HavocKiller
Threat Actors
Malware Families
Excerpt
An analysis of the Gentlemen ransomware-as-a-service (RaaS) gang’s sophisticated EDR killer suite reveals a centralized approach to disabling security software that sets the group apart from nearly every other active ransomware operation. Gentlemen emerged in late 2025 and quickly became one of the five most active ransomware gangs in Q1 2026, offering affiliates a generous 90% revenue share. According to Group-IB, the gang was founded by a threat actor known as…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | a5cf917ec4a7dfbdfa43621398604805d860c718 | Medium | Score 53/100 | First seen |
| SHA1 | 7131b377e96016dc1911020c9f95b1b4d042d7b4 | Medium | Score 53/100 | First seen |
| SHA1 | f0537cbb773ae12100b36731e7c39f5a9d852b14 | Medium | Score 53/100 | First seen |
| SHA1 | 8ae6bd18b129061f63642531f1b684cf0383c75d | Medium | Score 53/100 | First seen |
| SHA1 | 56bee9df5833a637f5c54d5911df98b0812fe643 | Medium | Score 53/100 | First seen |
| SHA1 | ba914fe77b177b45799403b16dd14765c510a074 | Medium | Score 53/100 | First seen |
| SHA1 | cf4d74df17a91b4a36a2911b22afec5d8fa93a01 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…