A ransomware group called Gentlemen has been making headlines for a particularly aggressive tactic: before it encrypts a single file, it systematically disables the security software protecting your systems. This approach, using what researchers call EDR killers, marks a dangerous evolution in ransomware attacks that every small and medium business owner should understand.
What Is an EDR Killer and Why Does It Matter?
EDR stands for Endpoint Detection and Response — the software businesses use to monitor devices for suspicious activity and stop threats in real time. Think of it as a security guard watching your computers. An EDR killer is a tool specifically designed to fire that security guard before the attack begins.
The Gentlemen ransomware group doesn't just use one of these tools. They deploy multiple EDR killers in sequence, trying different methods until one works. This layered approach means that even if your security software blocks one technique, another may succeed. Once your defenses are blind, the ransomware deploys freely, encrypting files and demanding payment before you even know something has gone wrong.
This matters enormously for SMBs because many smaller businesses rely heavily on a single security product as their primary line of defense. When that product gets switched off by the attacker, there is often nothing else standing in the way.
How Attackers Get Into Position to Disable Your Defenses
Here is the part that often gets overlooked in ransomware reporting: attackers don't just appear inside your network and start running tools. They get in first, usually through credentials that have already been compromised.
The most common entry points include stolen login credentials purchased on dark web markets, employee passwords exposed in third-party data breaches, and session tokens harvested by infostealer malware. Once an attacker has valid credentials, they can log in as a legitimate user, move quietly through your network, elevate their privileges, and then deploy tools like EDR killers without triggering obvious alarms.
This is why credential exposure is not just a password hygiene problem. It is a ransomware problem. The Gentlemen group, like most sophisticated ransomware operators, almost certainly used compromised access to reach a position where they could begin disabling defenses. The encryption phase is the last step in an attack that started much earlier, often with a single leaked password.
What SMBs Should Do Right Now
The response to this threat isn't to panic — it's to close the gaps that attackers exploit before they get the chance. A few concrete steps make a real difference.
First, find out whether your business credentials are already circulating in breach databases, infostealer logs, or dark web markets. Many SMBs are surprised to discover that employee email addresses and passwords from old breaches are still being actively traded and used years later. Knowing your exposure is the starting point for everything else.
Second, enforce multi-factor authentication across every business account, especially those with administrative privileges. An EDR killer requires elevated system access to work. If attackers can't reach that level of access because MFA blocks their stolen credentials, the entire attack chain breaks.
Third, don't rely on a single security product. Layered defenses — combining endpoint protection, network monitoring, and regular access reviews — give you resilience even when one layer is targeted. Attackers using multiple EDR killers are counting on your defenses having a single point of failure.
Finally, review who has administrative access to your systems. Reducing the number of accounts with high privileges shrinks the attack surface that groups like Gentlemen can exploit.
The Bigger Picture for Business Security in 2026
The Gentlemen ransomware group represents where cybercrime is heading: more automated, more adaptable, and more focused on neutralising defenses before launching the main attack. For SMBs, the threat is real and growing, but it is not unmanageable.
The businesses that fare best are the ones that treat credential exposure and dark web monitoring as a routine part of their security posture — not a one-time exercise. Knowing what attackers already know about your business gives you a significant advantage. Gentlemen ransomware and groups like it depend on businesses staying in the dark about their own vulnerabilities.
Find out what's exposed before someone else acts on it. Run a free audit of your business at breachrr.com/audit and see exactly what Breachrr finds across breach databases, infostealer dumps, dark web markets, and your domain infrastructure.
Want to see if your company is exposed?