Gentlemen Ransomware Uses TukTuk C2 for Credential Theft

The Gentlemen ransomware operation has been linked to a new command-and-control framework named TukTuk, which is used to steal credentials and disable endpoint detection and response (EDR) security tools. This cross-platform framework has been associated with attacks on technology and healthcare organizations. Researchers discovered a Finland-hosted server containing the complete TukTuk development project, revealing the group's advanced post-compromise capabilities. The malware enables operators to surveil compromised machines while weakening defenses. The full scope of the impact is still being assessed, but the operation's sophistication indicates a significant threat to affected sectors. Current status is ongoing, with further analysis required to understand the full extent of the TukTuk framework's capabilities.

Key Points: • TukTuk is a new command-and-control framework linked to the Gentlemen ransomware. • The framework is used to steal credentials and disable EDR security tools. • Attacks have targeted technology and healthcare organizations, indicating a broad impact.