Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

216.73.217.22

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

· Published 11/05/2026 18:15 · Modified 11/05/2026 19:28

Essential information

Published: 11/05/2026 18:15
Modified: 11/05/2026 19:28
Source / Author: AlienVault
Confidence: 100/100
Report type(s): threat-report
Labels / Tags: blockchain c2 cve-2025-55182 dll sideloading ethereum etherrat kerberoasting mimikatz netexec rclone saas abuse the gentlemen the gentlemen ransomware tuktuk
Tags: 2026-05-11 CVE-2025-55182 blockchain c2 dll sideloading ethereum etherrat kerberoasting mimikatz netexec rclone saas abuse the gentlemen the gentlemen ransomware tuktuk
Related entities: 1 vulnerabilities (cve), 32 indicators, 32 observables, 23 techniques (mitre), 6 malware, 15 others

Description

An intrusion was observed in April 2026 where threat actors deployed EtherRAT malware through a malicious MSI installer disguised as a Sysinternals tool. The malware utilized Ethereum blockchain via EtherHiding for dynamic C2 configuration updates. Following reconnaissance activities, actors deployed TukTuk malware framework using DLL sideloading techniques with legitimate applications like Greenshot and SyncTrayzor. TukTuk established C2 channels through SaaS platforms including ClickHouse and Supabase, with backup channels via Ably, Dropbox, and GitHub Issues. The actors performed Kerberoasting, credential theft via Mimikatz and LSASS dumping, and deployed GoTo Resolve RMM tooling for lateral movement. Data exfiltration to Wasabi cloud storage was conducted using Rclone before deploying The Gentlemen ransomware domain-wide through a malicious GPO. The intrusion leveraged blockchain infrastructure, SaaS platforms, and decentralized services to evade traditional network defenses.