Published on September 6, 2026
Ransomware Hackers Use New TukTuk Malware to Steal Credentials and Disable Security Tools
Severity
Medium
Detail
Oasis Security researchers have uncovered a previously undocumented remote-control command-and-control (C2) framework dubbed TukTuk, linked to the Gentlemen ransomware operation. Discovered on an attacker-controlled server alongside EDR-disabling tools, DLL sideloading packages, and exfiltrated sensitive data from healthcare and defense-sector entities, TukTuk provides operators with a full-suite administration and surveillance platform.
Featuring cross-platform agents for Windows and Linux, custom credential-phishing modules, and integration with kernel-level driver abuse tools, the framework enables threat actors to execute credential theft, system surveillance, and defense evasion prior to ransomware deployment.
How?
The TukTuk framework operates as a centralized C2 ecosystem consisting of Windows and Linux agents, a backend server, and an operator panel. On Windows endpoints, the framework frequently relies on DLL sideloading for initial stealth and execution, placing a malicious log4net.dll alongside the legitimate, signed binary Greenshot.exe to execute undetected within trusted application memory.
Once active on a host, TukTuk establishes persistent communication with its backend server. The framework allows operators to harvest detailed system metadata, execute arbitrary commands, manage files, capture screenshots, and track agent activity across mixed-operating-system environments.
To harvest high-value credentials without relying solely on memory dumping, the operator panel includes a built-in module that spawns a fake, convincing Windows Security prompt on the victim’s screen, capturing plaintext credentials entered by the user and exfiltrating them directly to the C2 panel.
To prepare the environment for final data exfiltration and ransomware deployment, the operators combine TukTuk with specialized EDR-neutralization tooling (including EDRKiller, WarsawKiller, and UnknownKiller). The threat actors leverage Bring Your Own Vulnerable Driver (BYOVD) techniques using vulnerable drivers such as eb.sys (tied to the GentleKiller ransomware ecosystem) to terminate kernel-level security processes and disable endpoint detection controls.
Recovered server artifacts reveal that the operators systematically gather cloud infrastructure credentials (AWS, Azure AD, Bitbucket) and platform data (such as Jira tickets) to expand administrative access across internal environments before initiating encryption.
Conclusion
TukTuk represents a versatile control layer that bridges initial access, internal surveillance, and defense evasion for ransomware operations. Defensive efforts must focus on detecting kernel-level driver abuse, blocking unauthorized DLL sideloading, and enforcing strict identity verification across cloud and endpoint environments.
To mitigate this threat, organizations should enable Microsoft’s Vulnerable Driver Blocklist and enforce strict driver allowlisting to prevent BYOVD attacks.
Security teams should configure EDR solutions to inspect process-to-DLL relationships for co-located DLL sideloading anomalies (e.g., Greenshot.exe loading log4net.dll outside standard paths) and audit unexpected credential prompts or screen-capture activity.
Additionally, enterprises should enforce mandatory password resets for potentially exposed accounts, audit cloud/Jira access logs for unusual data exfiltration, and isolate any endpoints exhibiting unexplained kernel service creation or EDR process termination.
Source