Security researchers at ESET have flagged a worrying new trend in the ransomware world. A criminal group known as “The Gentlemen” is renting out a ready-made attack kit that includes a dedicated tool, dubbed GentleKiller, built to switch off the very software meant to protect your computers. According to the report, it targets around 400 processes belonging to 48 different security products – including mainstream antivirus and the modern “EDR” detection tools many businesses rely on.
Why this matters to your business. Ransomware-as-a-service means low-skilled criminals can now pay for a polished kit and point it at any business they like. The clever part is the order of attack: before the ransomware locks up your files, GentleKiller tries to blind your defences first. If your security software is disabled, the encryption can run unnoticed – and the first you know about it is a ransom note. Small and medium businesses are squarely in the firing line because attackers assume your defences are thinner and your backups patchier.
Three practical takeaways.
- Protect your security tools. Turn on tamper protection in your antivirus or EDR so it can’t be silently switched off, and make sure only administrators can change or uninstall it.
- Test your backups. Keep at least one backup copy offline or otherwise out of reach of the network, and actually restore from it now and then. A backup you’ve never tested is a guess, not a safety net.
- Watch for the warning signs. Security software suddenly turning off, alerts going quiet, or staff being logged out can be the opening move of an attack – not a glitch to ignore.
You don’t need an enterprise budget to make these attacks far harder. Tamper protection, tested backups and someone keeping an eye on alerts cover most of the gap that kits like this one are built to exploit.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.