Ransomware Hackers Use New TukTuk Malware to Steal Credentials and Disable Security Tools

Cybersecuritynews •Tushar Subhra Dutta • September 2, 2026

Ransomware operators are using a previously undocumented remote-control framework called TukTuk to steal credentials, watch compromised machines, and weaken protections. The discovery links the tool to activity associated with the Gentlemen ransomware operation and shows how one intrusion can combine access theft, surveillance, and defense evasion. Its recovery gives defenders an unusual view of the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen Ransomware Uses TukTuk C2 for Credential Theft The Gentlemen ransomware operation has been linked to a new command-and-control framework named TukTuk, which is used to steal credentials and disable endpoint detection and response (EDR) security tools. This cross-platform framework has been associated with attacks on technology and healthcare organizations. Researchers discovered a Finland-hosted server containing the complete TukTuk development project, revealing the group's advanced post-compromise capabilities. The malware enables operators to surveil compromised machines while weakening defenses. The full scope of the impact is still being assessed, but the operation's sophistication indicates a significant threat to affected sectors. Current status is ongoing, with further analysis required to understand the full extent of the TukTuk framework's capabilities. 2 sources 61

Extracted Entities

Ransomware Hackers Use New TukTuk Malware to Steal Credentials and Disable Security Tools

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Ransomware Groups (1)

Tools (1)