{
  "name": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware",
  "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware",
  "description": "An intrusion was observed in April 2026 where threat actors deployed EtherRAT malware through a malicious MSI installer disguised as a Sysinternals tool. The malware utilized Ethereum blockchain via EtherHiding for dynamic C2 configuration updates. Following reconnaissance activities, actors deployed TukTuk malware framework using DLL sideloading techniques with legitimate applications like Greenshot and SyncTrayzor. TukTuk established C2 channels through SaaS platforms including ClickHouse and Supabase, with backup channels via Ably, Dropbox, and GitHub Issues. The actors performed Kerberoasting, credential theft via Mimikatz and LSASS dumping, and deployed GoTo Resolve RMM tooling for lateral movement. Data exfiltration to Wasabi cloud storage was conducted using Rclone before deploying The Gentlemen ransomware domain-wide through a malicious GPO. The intrusion leveraged blockchain infrastructure, SaaS platforms, and decentralized services to evade traditional network defenses.",
  "published": "2026-05-11T16:15:42.099000+00:00",
  "created_at": "2026-05-11T19:28:01.776000+00:00",
  "modified_at": "2026-05-11T17:28:01+00:00",
  "created_at_opencti": "2026-05-11T19:28:01.776000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "blockchain c2",
    "cve-2025-55182",
    "dll sideloading",
    "ethereum",
    "etherrat",
    "kerberoasting",
    "mimikatz",
    "netexec",
    "rclone",
    "saas abuse",
    "the gentlemen",
    "the gentlemen ransomware",
    "tuktuk"
  ],
  "tags": [
    "2026-05-11",
    "CVE-2025-55182",
    "blockchain c2",
    "dll sideloading",
    "ethereum",
    "etherrat",
    "kerberoasting",
    "mimikatz",
    "netexec",
    "rclone",
    "saas abuse",
    "the gentlemen",
    "the gentlemen ransomware",
    "tuktuk"
  ],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "1c7365fc-dc25-4eb9-af39-65b680dd116e",
        "name": "CVE-2025-55182"
      }
    ],
    "indicators": [
      {
        "id": "ef4d2b0b-05cf-4eb9-a246-37122836b5be",
        "name": "mode-exit-legendary-trusted.trycloudflare.com"
      },
      {
        "id": "4b1c3502-c2a0-40b9-9943-8aa9cd15af22",
        "name": "https://fields-pct-easier-vancouver.trycloudflare.com"
      },
      {
        "id": "2435fea8-295d-4824-a9ce-8275082e370b",
        "name": "https://afford-effect-construct-tricks.trycloudflare.com"
      },
      {
        "id": "131731b2-c469-4ee4-a785-208e54f1b73e",
        "name": "fields-pct-easier-vancouver.trycloudflare.com"
      },
      {
        "id": "ff444865-cf5e-4cfe-9fd6-bbc6d0de28a7",
        "name": "https://seasonal-estimation-heating-necessarily.trycloudflare.com"
      },
      {
        "id": "9435dcf4-08dd-493e-8133-e5459066ef7a",
        "name": "g8way.io"
      },
      {
        "id": "d4e8b570-5f64-4dff-aae1-de27e7960b65",
        "name": "when-architectural-cdna-faster.trycloudflare.com"
      },
      {
        "id": "5fec11b4-eb9e-405f-85e7-bc7f7b0ad818",
        "name": "borjumaniya.store"
      },
      {
        "id": "b7717ae8-a599-4ccb-b504-1a42b83a453a",
        "name": "walt-messaging-affairs-occurring.trycloudflare.com"
      },
      {
        "id": "68a07a05-58a7-4d5f-ad4a-a8c7dab78ec1",
        "name": "witch-skins-lip-coal.trycloudflare.com"
      },
      {
        "id": "9c06251d-26c8-4630-b74f-30b2fe3c8614",
        "name": "https://entered-medications-motherboard-advanced.trycloudflare.com"
      },
      {
        "id": "5239b5fe-9247-4ff7-8ad7-dcb362562bbc",
        "name": "https://rapids-lil-lending-charleston.trycloudflare.com"
      },
      {
        "id": "0a52b531-4092-49ad-b93b-e5a96f7058f2",
        "name": "8c2665adf8bfab65463f2a9bd1b7bb0231de3f5c1e6a2e51479e44aaac2e7bf0"
      },
      {
        "id": "bbdbd685-ced8-4011-b559-959fd592d085",
        "name": "d9487fdc097f770e5661f9e5dee130068cb179d33716abff1a21c8cb901f25a6"
      },
      {
        "id": "1c7bd5a7-536c-4213-86c2-8b3df12f147d",
        "name": "seasonal-estimation-heating-necessarily.trycloudflare.com"
      },
      {
        "id": "ea2001b4-28b9-4ca0-b99f-76d739ce7004",
        "name": "entered-medications-motherboard-advanced.trycloudflare.com"
      },
      {
        "id": "3db1e07d-7497-43f7-8346-48096e256fb4",
        "name": "https://when-architectural-cdna-faster.trycloudflare.com"
      },
      {
        "id": "562cd222-efc8-4612-9df1-4e7500126528",
        "name": "19021e53b9929fdf4b7d0e0707434d56bb73c1a9b7403c8837b44d1c417198dc"
      },
      {
        "id": "5e289429-795c-4687-94af-3ab9b5d8f402",
        "name": "2d4b4bb18b8445e49eeda571982874403befcecf78266e3d405f6529d98bee46"
      },
      {
        "id": "54577c70-fe34-49db-97c2-366b947b04c0",
        "name": "https://walt-messaging-affairs-occurring.trycloudflare.com"
      },
      {
        "id": "5f457174-635b-444c-8cce-2b403d354268",
        "name": "https://howto-tar-naturals-coordination.trycloudflare.com"
      },
      {
        "id": "c31b9c47-31b3-4d5f-9070-d58153572b2d",
        "name": "1795eacd2c58894ccdd6be8854fe6456c3b069a3a873432343b57b475b256aee"
      },
      {
        "id": "c59fc542-a383-41bd-bd5e-bdc95589c3bd",
        "name": "afford-effect-construct-tricks.trycloudflare.com"
      },
      {
        "id": "f8eca3da-c29d-4abc-92bc-2adb7091d0a3",
        "name": "howto-tar-naturals-coordination.trycloudflare.com"
      },
      {
        "id": "b1e36025-e742-40bd-95d0-ed36b8d11b6f",
        "name": "https://witch-skins-lip-coal.trycloudflare.com"
      },
      {
        "id": "b9ef6e9f-bab3-45a9-9e1a-3cff5eb9a980",
        "name": "workshop-lighting-protective-customs.trycloudflare.com"
      },
      {
        "id": "94bbe0cc-1448-4d3b-96b5-9a3beb3f9711",
        "name": "rapids-lil-lending-charleston.trycloudflare.com"
      },
      {
        "id": "4ba77227-7f0d-4ab0-b792-dac5a93dd3c1",
        "name": "https://workshop-lighting-protective-customs.trycloudflare.com"
      },
      {
        "id": "faf2df54-773f-4497-a279-d589748b3a6f",
        "name": "vngz3ntdrb.us-east1.gcp.clickhouse.cloud"
      },
      {
        "id": "82862619-4dc2-4ac7-b66a-3a598993f0f5",
        "name": "k135neflez.westus3.azure.clickhouse.cloud"
      },
      {
        "id": "c351d7ae-50c2-4aeb-8aed-8fa06bc0d138",
        "name": "4142d5efd4ea2abab77f2f0a917610e2ff976bf9e19d7ad1e9156eccdc5412db"
      },
      {
        "id": "9950eda1-1e9e-4ffc-b1e3-7bb9d2665d09",
        "name": "https://mode-exit-legendary-trusted.trycloudflare.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "5d2af906-6187-4702-ab9f-590fbe5b1ca3",
        "name": "T1021.002"
      },
      {
        "id": "5fad1837-fafc-4be9-808a-b6282e4c3c6b",
        "name": "T1003.003"
      },
      {
        "id": "6b5f1e68-aec7-4ea0-9777-62156da790a7",
        "name": "T1069"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "840f859f-575f-487e-8083-6ffd01a13a84",
        "name": "T1218.007"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "fd6a3ae8-f3af-41a6-9292-09912a059105",
        "name": "T1558.003"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "e6c0ca23-78ee-4b0e-96fa-e80efab3665d",
        "name": "T1003.001"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "da44e22e-1925-42e4-b30d-ac38860d39bb",
        "name": "T1070.001"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "a15721d2-76b1-4869-bd1f-819afb6e368d",
        "name": "T1482"
      }
    ],
    "malware": [
      {
        "id": "10ade440-687e-45c6-992a-3b0ab99cb572",
        "name": "The Gentlemen",
        "slug": "the-gentlemen"
      },
      {
        "id": "4c5f5285-091d-4bf7-8c48-f6b5e6e38fee",
        "name": "EtherRAT",
        "slug": "etherrat"
      },
      {
        "id": "499c49bc-ac94-42c0-8add-43140b8c35bc",
        "name": "NetExec",
        "slug": "netexec"
      },
      {
        "id": "22fc324a-b28d-4310-81d2-7f74d208ca13",
        "name": "Rclone",
        "slug": "rclone"
      },
      {
        "id": "dce99d4d-6307-4cd3-9554-4caa32be8459",
        "name": "mimikatz",
        "slug": "mimikatz"
      },
      {
        "id": "ec2113c4-eb17-433d-aadb-c3f9e82313aa",
        "name": "TukTuk",
        "slug": "tuktuk"
      }
    ],
    "observables": [
      {
        "id": "f92bccbf-8dfd-4ace-9ee2-776f622510f4",
        "name": "g8way.io"
      },
      {
        "id": "373308fc-9ec6-488c-804e-2acde1d44fbc",
        "name": "borjumaniya.store"
      },
      {
        "id": "b57fcae4-72ec-42d1-bf65-d18fcc01e533",
        "name": "vngz3ntdrb.us-east1.gcp.clickhouse.cloud"
      },
      {
        "id": "55e3d733-9a32-4dec-ad90-c14136d56760",
        "name": "witch-skins-lip-coal.trycloudflare.com"
      },
      {
        "id": "0f6b17bd-b0c0-43dc-a788-86ccb27b7011",
        "name": "fields-pct-easier-vancouver.trycloudflare.com"
      },
      {
        "id": "e6c6216b-5ea1-400f-bb4a-3dfaef8594c2",
        "name": "workshop-lighting-protective-customs.trycloudflare.com"
      },
      {
        "id": "d6efd675-50f6-4678-b075-794dbf34135b",
        "name": "k135neflez.westus3.azure.clickhouse.cloud"
      },
      {
        "id": "f699acc2-d3d9-4ba0-92d6-ed6f864e0a6a",
        "name": "mode-exit-legendary-trusted.trycloudflare.com"
      },
      {
        "id": "f52b7fad-5efb-40fb-9d0d-ded2ad2f9834",
        "name": "rapids-lil-lending-charleston.trycloudflare.com"
      },
      {
        "id": "f9c8dc8a-6adf-4cb8-9abf-6091b8486899",
        "name": "howto-tar-naturals-coordination.trycloudflare.com"
      },
      {
        "id": "9acabd7c-ced3-4023-af34-16a7446156e2",
        "name": "afford-effect-construct-tricks.trycloudflare.com"
      },
      {
        "id": "e34260b9-6135-4bb4-ad88-e7bfe470a5d0",
        "name": "entered-medications-motherboard-advanced.trycloudflare.com"
      },
      {
        "id": "409f69c2-9de0-4644-b0d1-121d4c2014a9",
        "name": "walt-messaging-affairs-occurring.trycloudflare.com"
      },
      {
        "id": "49903b50-6447-4acf-89d4-63d20f214e74",
        "name": "seasonal-estimation-heating-necessarily.trycloudflare.com"
      },
      {
        "id": "736601c1-334a-4238-b9d2-939963957aa4",
        "name": "when-architectural-cdna-faster.trycloudflare.com"
      },
      {
        "id": "7e224618-b690-486c-8a63-98feb3ad9eea",
        "name": "https://entered-medications-motherboard-advanced.trycloudflare.com"
      },
      {
        "id": "9cefaa6d-95f7-43a2-b14b-c22d52c5ef73",
        "name": "https://fields-pct-easier-vancouver.trycloudflare.com"
      },
      {
        "id": "593e0e05-8f01-4f31-87d5-0755420619d2",
        "name": "https://afford-effect-construct-tricks.trycloudflare.com"
      },
      {
        "id": "7564d542-8cc3-4c1b-be86-e87b97213576",
        "name": "https://seasonal-estimation-heating-necessarily.trycloudflare.com"
      },
      {
        "id": "5f86d06a-bdc7-4b9b-b2f6-37cf82ca94b9",
        "name": "https://mode-exit-legendary-trusted.trycloudflare.com"
      },
      {
        "id": "d7ef4204-ba6a-4aa7-b607-9c021f2b3e4d",
        "name": "https://rapids-lil-lending-charleston.trycloudflare.com"
      },
      {
        "id": "9eea6fea-4945-4bdb-b832-d0d90d7e1162",
        "name": "https://when-architectural-cdna-faster.trycloudflare.com"
      },
      {
        "id": "18938e12-8578-4a62-a4c1-76aeb2b6f3c1",
        "name": "https://workshop-lighting-protective-customs.trycloudflare.com"
      },
      {
        "id": "97f73c0c-4464-4f46-a0ac-b5a859212170",
        "name": "https://walt-messaging-affairs-occurring.trycloudflare.com"
      },
      {
        "id": "219b6da6-b52f-42a1-b965-6413283fcd9d",
        "name": "https://witch-skins-lip-coal.trycloudflare.com"
      },
      {
        "id": "a03783ef-1c2e-4c8a-8d6b-dcd8e74de983",
        "name": "https://howto-tar-naturals-coordination.trycloudflare.com"
      },
      {
        "id": "",
        "name": "8c2665adf8bfab65463f2a9bd1b7bb0231de3f5c1e6a2e51479e44aaac2e7bf0"
      },
      {
        "id": "",
        "name": "d9487fdc097f770e5661f9e5dee130068cb179d33716abff1a21c8cb901f25a6"
      },
      {
        "id": "",
        "name": "19021e53b9929fdf4b7d0e0707434d56bb73c1a9b7403c8837b44d1c417198dc"
      },
      {
        "id": "",
        "name": "2d4b4bb18b8445e49eeda571982874403befcecf78266e3d405f6529d98bee46"
      },
      {
        "id": "",
        "name": "1795eacd2c58894ccdd6be8854fe6456c3b069a3a873432343b57b475b256aee"
      },
      {
        "id": "",
        "name": "4142d5efd4ea2abab77f2f0a917610e2ff976bf9e19d7ad1e9156eccdc5412db"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "mode-exit-legendary-trusted.trycloudflare.com"
      },
      {
        "id": "",
        "name": "fields-pct-easier-vancouver.trycloudflare.com"
      },
      {
        "id": "",
        "name": "g8way.io"
      },
      {
        "id": "",
        "name": "when-architectural-cdna-faster.trycloudflare.com"
      },
      {
        "id": "",
        "name": "borjumaniya.store"
      },
      {
        "id": "",
        "name": "walt-messaging-affairs-occurring.trycloudflare.com"
      },
      {
        "id": "",
        "name": "witch-skins-lip-coal.trycloudflare.com"
      },
      {
        "id": "",
        "name": "seasonal-estimation-heating-necessarily.trycloudflare.com"
      },
      {
        "id": "",
        "name": "entered-medications-motherboard-advanced.trycloudflare.com"
      },
      {
        "id": "",
        "name": "afford-effect-construct-tricks.trycloudflare.com"
      },
      {
        "id": "",
        "name": "howto-tar-naturals-coordination.trycloudflare.com"
      },
      {
        "id": "",
        "name": "workshop-lighting-protective-customs.trycloudflare.com"
      },
      {
        "id": "",
        "name": "rapids-lil-lending-charleston.trycloudflare.com"
      },
      {
        "id": "",
        "name": "vngz3ntdrb.us-east1.gcp.clickhouse.cloud"
      },
      {
        "id": "",
        "name": "k135neflez.westus3.azure.clickhouse.cloud"
      }
    ]
  },
  "external_refs": [
    {
      "id": "a5b466a7-7092-4da8-994d-2d51d5f44a6d",
      "standard_id": "external-reference--34a2cf05-1e2e-51ac-aa61-487dac82825a",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/",
      "hash": null,
      "external_id": null,
      "created": "2026-05-11T19:27:59.207Z",
      "modified": "2026-05-11T19:27:59.207Z",
      "createdById": null
    },
    {
      "id": "3b07206b-a0a4-4d00-8c80-fb1b28ac2c1b",
      "standard_id": "external-reference--63a48eba-ad0f-5351-b5fc-5fb5c48ab4ec",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a0200aec25a59a6b9d4edcf",
      "hash": null,
      "external_id": "6a0200aec25a59a6b9d4edcf",
      "created": "2026-05-11T19:27:59.179Z",
      "modified": "2026-05-11T19:27:59.179Z",
      "createdById": null
    }
  ]
}