The Gentlemen Ransomware Hackers Use TukTuk C2 to Steal Credentials and Disable EDR Security

Gbhackers •Mayura Kathir • September 2, 2026

The Gentlemen ransomware operation has been linked to a previously undocumented, cross-platform command-and-control framework named TukTuk, alongside EDR-disabling tooling, DLL sideloading research, and datasets apparently stolen from technology and healthcare organizations. Analysis of a Finland-hosted server identified what researchers assess as the complete TukTuk development project, providing an unusually detailed view into the group’s post-compromise capabilities. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen Ransomware Uses TukTuk C2 for Credential Theft The Gentlemen ransomware operation has been linked to a new command-and-control framework named TukTuk, which is used to steal credentials and disable endpoint detection and response (EDR) security tools. This cross-platform framework has been associated with attacks on technology and healthcare organizations. Researchers discovered a Finland-hosted server containing the complete TukTuk development project, revealing the group's advanced post-compromise capabilities. The malware enables operators to surveil compromised machines while weakening defenses. The full scope of the impact is still being assessed, but the operation's sophistication indicates a significant threat to affected sectors. Current status is ongoing, with further analysis required to understand the full extent of the TukTuk framework's capabilities. 2 sources 61

Extracted Entities

The Gentlemen Ransomware Hackers Use TukTuk C2 to Steal Credentials and Disable EDR Security

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Industries (2)

MITRE ATT&CK (4)

Ransomware Groups (1)

Tools (1)