Reported by 2 outlets
The Gentlemen Ransomware Group Deployed Custom TukTuk C2 Framework
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.52 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Ransomware Hackers Built Their Own C2 Framework to Steal Passwords and Kill Security Tools
cyberpress.org · 41d ago · September 2nd, 2026
A newly analyzed server linked to the ransomware group The Gentlemen contained a previously undocumented command-and-control (C2) framework called TukTuk, tools designed to disable endpoint security products, and data believed to have been stolen from two global companies. Threat intelligence researchers identified the server at IP address 65.109.70.162, hosted by Hetzner Online in Finland. The collected files included the full TukTuk C2 project, malicious DLL sideloading components, EDR-killing tools, vulnerable-driver research, and exfiltrated corporate information. Researchers said the evidence connects the infrastructure to The Gentlemen ransomware operation. One major indicator was an eb.sys file whose hash matched GentleKiller, a driver previously associated with the group. The server also contained a Greenshot DLL sideloading package consistent with techniques previously linked to The Gentlemen. Ransomware C2 Disarms Defenses The complete TukTuk v2.0 project archive was found on the server, including separate Windows and Linux agents, a backend server component, and an operator control panel. Researchers said they could not find any earlier public disclosure or documentation for the full project structure. TukTuk C2 dashboard showing hostname DESKTOP-22EVPBQ (Source: oasis) TukTuk allows operators to monitor compromised devices, run commands, manage files, capture screenshots, and control running processes. Its panel includes a credential-focused feature that can displ
-
update from gbhackers.com
The Gentlemen Ransomware Hackers Use TukTuk C2 to Steal Credentials and Disable EDR Security
gbhackers.com · 41d ago · September 2nd, 2026
The Gentlemen ransomware operation has been linked to a previously undocumented, cross-platform command-and-control framework named TukTuk, alongside EDR-disabling tooling, DLL sideloading research, and datasets apparently stolen from technology and healthcare organizations. Analysis of a Finland-hosted server identified what researchers assess as the complete TukTuk development project, providing an unusually detailed view into the group’s post-compromise capabilities. […] The post The Gentlemen Ransomware Hackers Use TukTuk C2 to Steal Credentials and Disable EDR Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .