Reported by 1 outlet

Timeline

1. original reporting

   DFIR Report documents The Gentlemen ransomware — EtherRAT via blockchain C2, AI-generated TukTuk framework, SaaS-based command infrastructure

   thedfirreport.com · 155d ago · May 12th, 2026

   The DFIR Report has published a flash alert documenting a complete intrusion chain ending in The Gentlemen ransomware deployment. Initial access came via a malicious MSI masquerading as Sysinternals RAMMap, which deployed EtherRAT — a malware family that uses the Ethereum blockchain via EtherHiding to dynamically update its C2 configuration by querying smart contracts through 1rpc.io. The threat actor later deployed TukTuk, a newly documented malware framework believed to be AI-generated, using DLL sideloading through trojanized Greenshot, SyncTrayzor, DocFX, and Cake binaries. TukTuk's C2 infrastructure is built entirely on SaaS platforms — ClickHouse, Supabase, Ably, Dropbox, GitHub Issues — with Arweave blockchain dead-drop resolution as a fallback. The intrusion progressed through Kerberoasting, LSASS/NTDS credential dumping via comsvcs.dll, lateral movement using GoTo Resolve RMM, and data exfiltration to Wasabi cloud storage via Rclone, culminating in domain-wide ransomware deployment through a malicious Group Policy Object. The heavy use of blockchain and SaaS infrastructure makes this campaign resilient to traditional network defenses — defenders should monitor for unexpected outbound connections to Ethereum RPC endpoints, Arweave gateways, and SaaS platforms not approved in their environment.