Gentlemen Ransomware Uses TukTuk C2 for Credential Theft
Article Content
- •TukTuk is a new command-and-control framework linked to the Gentlemen ransomware.
- •The framework is used to steal credentials and disable EDR security tools.
- •Attacks have targeted technology and healthcare organizations, indicating a broad impact.
The Gentlemen ransomware operation has been linked to a new command-and-control framework named TukTuk, which is used to steal credentials and disable endpoint detection and response (EDR) security tools. This cross-platform framework has been associated with attacks on technology and healthcare organizations. Researchers discovered a Finland-hosted server containing the complete TukTuk development project, revealing the group's advanced post-compromise capabilities. The malware enables operators to surveil compromised machines while weakening defenses. The full scope of the impact is still being assessed, but the operation's sophistication indicates a significant threat to affected sectors. Current status is ongoing, with further analysis required to understand the full extent of the TukTuk framework's capabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Gentlemen in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…