Kernel Evasion & EDR Neutralization: "The Gentlemen" Ransomware Deploys Signed BYOVD Driver (anticheatG13.sys) to Terminate 180+ Security Tools
Executive Summary
Cybersecurity threat researchers released detailed forensic telemetry on August 21–22, 2026, exposing an advanced defense evasion technique utilized by The Gentlemen ransomware syndicate. The threat actors are actively deploying a Bring Your Own Vulnerable Driver (BYOVD) attack using a cryptographically signed, legitimate gaming anticheat driver named anticheatG13.sys. Operating at the deepest kernel level (Ring 0), the malicious driver systematically terminates nearly 180 security-related processes—including enterprise Endpoint Detection and Response (EDR) agents, antivirus engines, and backup software—before initiating file encryption, leaving victims defenseless and unable to restore systems from online backups.
Deep-Dive Technical Analysis of the anticheatG13.sys Kernel Driver
The driver executes a comprehensive, multi-phase teardown of host security controls:
1. Ring 0 Kernel Execution & Process Termination Matrix
The BYOVD technique exploits Windows Driver Signature Enforcement to load trusted code with known flaws:
* The BYOVD Mechanism: Because 64-bit Windows enforces Driver Signature Enforcement, attackers cannot load custom unsigned drivers. Instead, they install a legitimate, digitally signed third-party anticheat driver (anticheatG13.sys) containing known memory-manipulation flaws.
* Systematic Termination of 180 Processes: Running in kernel mode beneath user-space security software, the driver traverses the active process list and forcibly terminates executable binaries. Targeted software includes Microsoft Defender (MsMpEng.exe), CrowdStrike Falcon (CSFalconService.exe), SentinelOne (SentinelAgent.exe), Sophos, Trend Micro, and enterprise backup solutions such as Veeam (VeeamDeploymentSvc.exe) and Commvault.
* Destructive Memory Corruption: If clean process termination fails, the driver corrupts the target process memory space directly in kernel memory, inducing silent application crashes.
2. Network Redirection & Telemetry Suppression
The driver suppresses outbound incident alerts to keep SOC teams blind:
* WFP Network Redirection: The driver manipulates the Windows Filtering Platform (WFP), establishing kernel-level network redirection rules that drop all outbound communication attempts from security agents, preventing EDR telemetry from reaching cloud consoles.
* Command-Line & Event Log Rewriting: The driver modifies kernel execution logs and rewrites command-line records to conceal lateral movement commands executed during the intrusion.
Threat Intelligence Category
Details
Threat Actor
The Gentlemen (Ransomware-as-a-Service Syndicate)
Malicious Component
anticheatG13.sys (Kernel-Mode BYOVD Driver)
Target Operating Systems
Microsoft Windows 10, Windows 11, Windows Server 2016–2025
Targeted Software
180+ Security Tools (EDR Agents, AV, Backup Daemons, SIEM)
MITRE ATT&CK Mapping
T1068 (Privilege Escalation), T1562.001 (Disable Tools), T1070 (Removal)
The Escalating Risk of Bring Your Own Vulnerable Driver (BYOVD) Attacks
BYOVD attacks represent one of the most dangerous evasion techniques in modern cybercrime. When an adversary acquires administrator privileges and drops a vulnerable signed driver, user-mode endpoint protection platforms lose their ability to defend the host. Furthermore, because the attack terminates online backup daemons prior to encryption, organizations that rely solely on connected network backups are stripped of their primary recovery mechanism.
Organizations must enforce hardware-rooted driver blocking and maintain isolated, immutable backup architectures.
Recommendations and Mitigations
Enterprise security teams, systems engineers, and SOC managers should implement the following defensive hardening controls:
1. Enable Hypervisor-Protected Code Integrity (HVCI) & Memory Integrity: Enforce HVCI and Virtualization-Based Security (VBS) via Group Policy or Intune to prevent vulnerable kernel drivers from executing unauthorized memory writes.
2. Deploy Microsoft's Vulnerable Driver Blocklist: Ensure Windows Defender Application Control (WDAC) is configured to enforce the Microsoft Vulnerable and Malicious Driver Blocklist, blocking anticheatG13.sys and related hashes.
3. Enforce Immutable, Air-Gapped Backups: Maintain offline, write-once-read-many (WORM) immutable backups that cannot be terminated or wiped via compromised Windows domain accounts.
4. Implement Ring 0 Driver Load Auditing: Configure SOC alerts and Sysmon (Event ID 6: Driver Loaded) to monitor for unrecognized or newly installed .sys drivers across all Windows endpoints.