Operators linked to the The Gentlemen ransomware are using a new command-and-control framework called TukTuk to steal credentials, monitor compromised machines, and prepare environments for ransomware attacks.
The framework was identified on a server that also stored tools for disabling EDR solutions, research on vulnerable drivers, and data apparently stolen from two large organizations. TukTuk features agents for both Windows and Linux, as well as its own backend and management panel. The structure allows operators to execute commands remotely, transfer files, capture screens, and track compromised devices from a single interface.
One of the capabilities displays a fake Windows Security window on the victim's computer. Credentials entered into this form are sent directly to the attackers' controlled panel. Researchers also discovered a DLL sideloading technique that uses the legitimate Greenshot.exe executable to load a malicious log4net.dll library and start the TukTuk agent on the system.
The server contained additional tools such as EDRKiller, WarsawKiller, and UnknownKiller, along with materials on BYOVD attacks. This technique uses legitimate but vulnerable drivers to obtain kernel access and interfere with security products.
Among the exposed data were 224 Jira tickets and eight attachments belonging to a global technology company, as well as credentials related to AWS, Azure AD, Bitbucket, and databases of a healthcare organization.
