ThrottleBlood
ThrottleBlood is a BYOVD-based EDR-killing tool observed in ransomware intrusions. It abuses a TechPowerUp LLC driver commonly referred to as ThrottleBlood.sys to disable or terminate security software. The tool has been repeatedly observed in MedusaLocker affiliate intrusions and less frequently in DragonForce affiliate activity. Multiple reports also link it to the Gentlemen ransomware-as-a-service ecosystem, where ESET assessed with high confidence that it was not developed in-house by Gentlemen but instead incorporated as an externally sourced or leaked third-party tool alongside HexKiller and HavocKiller. In Gentlemen-related use, ThrottleBlood was standardized through the group’s shared defense-evasion layer used across its EDR-killer suite. High-confidence associations in the content are therefore MedusaLocker, DragonForce, and Gentlemen. The content does not provide specific infection vectors or standalone indicators of compromise beyond the driver/tool name ThrottleBlood.sys.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ThrottleBlood Repeatedly observed in MedusaLocker affiliate intrusions and, less frequently, DragonForce affiliate activity. Trend Micro linked it to Gentlemen as early as September 2025.
Apart from the internally developed GentleKiller, Gentlemen has incorporated multiple third-party solutions into its suite... HexKiller, ThrottleBlood, and HavocKiller.
The group also incorporates third-party or leaked tools named HexKiller, ThrottleBlood and HavocKiller.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
ESET’s assessment is that all three were acquired externally by the operators and then standardized with the same defense evasion layer applied to GentleKiller: binary protection via Enigma or Themida, filenames mimicking security vendors, fabricated version information, copied digital signatures, and matching icons.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Stage 4 – Driver installation as a persistence/elevation step (T1543.003 – Create or Modify System Process: Windows Service). Each tool installs and starts its associated vulnerable or outright malicious kernel-mode driver as a Windows service before exploitation occurs.
Privilege Escalation
2 techniques
Privilege Escalation
The technique used is Bring Your Own Vulnerable Driver (BYOVD), loading a legitimately signed but exploitable driver to terminate security processes at the kernel level, bypassing user-mode protections.
Stage 4 – Driver installation as a persistence/elevation step (T1543.003 – Create or Modify System Process: Windows Service). Each tool installs and starts its associated vulnerable or outright malicious kernel-mode driver as a Windows service before exploitation occurs.
Stealth
5 techniques
Stealth
Defense Evasion T1027 Obfuscated Files or Information Some executables are protected with packers (Enigma, Themida) and custom control-flow obfuscation.
All three tools are standardized through a shared defense-evasion layer that applies Enigma or Themida binary protectors...
Stage 7 – Masquerading and obfuscation layered over the whole chain (T1036, T1036.001, T1027 – Masquerading, Masquerading: Invalid Code Signature, Obfuscated Files or Information). Every tool in the suite ... is run through the same standardization layer: commercial packers (Enigma/Themida), fabricated version information, icons copied from the impersonated vendor, and digital signatures copied from legitimate software.
Defense Impairment
1 technique
Defense Impairment
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A third-party EDR killer used in ransomware-related intrusions and incorporated into Gentlemen’s suite. It abuses ThrottleBlood.sys, a driver by TechPowerUp LLC, to impair security tools.
An EDR killer integrated into Gentlemen’s suite that abuses a TechPowerUp LLC driver. It was previously observed in MedusaLocker and DragonForce intrusions.
A third-party EDR-killer tool using a TechPowerUp driver, observed in ransomware affiliate attacks and incorporated into The Gentlemen's broader tooling.
A BYOVD-based EDR killer observed in ransomware-related attacks and used by The Gentlemen as a third-party defense-evasion tool.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.