Gentlemen Ransomware Gang Deploys Custom TukTuk Framework to Snag Logins and Neutralize EDRs

A previously unknown command-and-control (C2) infrastructure dubbed TukTuk has been linked to the Gentlemen ransomware operation, according to a technical analysis released by the security research collective GBHackers. The framework, which runs on both Windows and Linux environments, is being used to harvest user credentials and to deliver tools that temporarily disable endpoint detection and response (EDR) solutions, facilitating the group’s rapid encryption of target networks.

The investigation uncovered that TukTuk includes a suite of modules designed to blend into normal traffic, making detection harder for traditional network monitoring tools. In addition to its cross‑platform capabilities, the researchers identified a set of utilities that specifically target popular EDR products, temporarily suspending their real‑time monitoring functions long enough for the ransomware payload to execute without interruption.

Beyond the C2 and EDR‑bypass components, the analysis revealed that the Gentlemen actors have been experimenting with DLL sideloading techniques. By embedding malicious code into legitimate libraries, the attackers aim to evade heuristic scanners that typically flag stand‑alone malicious binaries. This approach mirrors tactics seen in other sophisticated ransomware campaigns, where stealth and persistence are prized over brute‑force exploitation.

Data theft appears to be a secondary objective for the group. The report mentions that large datasets, allegedly exfiltrated from technology and healthcare providers, were found on servers under the attackers’ control. While the precise value of the stolen information has not been disclosed, the inclusion of healthcare data raises concerns about potential exposure of personally identifying information, which could be leveraged for further extortion.

Security professionals note that the emergence of a bespoke C2 platform like TukTuk signals a maturation of the Gentlemen operation. Custom frameworks allow threat actors to tailor communication protocols, encryption methods, and evasion techniques to the specific defenses encountered in a target’s environment. This adaptability makes conventional signature‑based defenses less effective, pushing defenders toward behavior‑based detection and threat‑hunting strategies.

Experts advise organizations to review and harden their endpoint security stacks, ensuring that EDR solutions are configured to resist tampering and that privileged credential access is tightly controlled. Regular audits of DLL loading paths and the implementation of application allowlisting can also mitigate the risk of sideloading attacks. As investigators continue to dissect the TukTuk infrastructure, they expect further indicators of compromise to be released, helping the broader security community to recognize and neutralize this new threat vector before it gains wider foothold.