Malware campaigns utilizing EtherRat and TukTuk have culminated in the deployment of The Gentleman ransomware, according to recent analyses. These campaigns demonstrate a sophisticated, multi-stage approach, leveraging various tools and techniques to achieve initial access, maintain persistence, exfiltrate data, and ultimately encrypt systems.
The EtherRat malware family, first identified in December 2025, has evolved. Initially targeting Linux servers through the exploitation of CVE-2025-55182 (React2Shell), a Windows variant emerged by March 2026. This Windows variant was observed being deployed via a malicious MSI installer disguised as a Sysinternals tool.
Following the EtherRat deployment, a new malware framework named TukTuk was introduced. Reports suggest TukTuk may be AI-generated. The threat actors also utilized the GoTo Resolve remote management tool to gain further access and move laterally within victim networks.
A key characteristic of these campaigns is the use of resilient command-and-control (C2) infrastructure. EtherRat variants have been observed updating their configurations dynamically using the Ethereum blockchain via a technique called EtherHiding. This allows for stealthy updates to C2 server addresses, which can be hosted on services like TryCloudflare tunnels.
The threat actors also employed decoy domains alongside legitimate infrastructure to obscure their C2 traffic and complicate attribution efforts. After establishing initial C2 communication, the malware conducted extensive reconnaissance, gathering information about the host system, enumerating antivirus software, checking domain membership, and discovering user activity via LDAP.
Additional payloads, including TukTuk variants, were downloaded from cloud storage services like S3 buckets. These TukTuk payloads were often disguised as legitimate binaries, such as Greenshot, and deployed using DLL sideloading techniques. Other applications observed being abused for DLL sideloading include SyncTrayzor, DocFX, and the Cake build automation system.
TukTuk established its primary C2 channels through Software-as-a-Service (SaaS) platforms like ClickHouse and Supabase, with backup channels utilizing services such as Ably, Dropbox, direct HTTP, or GitHub Issues. The malware also possesses the capability to query the Arweave blockchain for encrypted configuration data, which contains credentials for various C2 transports, though this specific functionality was not confirmed as used in the observed intrusion.
Once TukTuk was active, the attackers engaged in hands-on keyboard activity. This included operations like Kerberoasting, credential discovery targeting administrative accounts, and lateral movement using compromised service account credentials to deploy GoTo Resolve across multiple systems, including servers and domain controllers.
Further lateral movement and credential access were achieved through methods such as RDP, SMB, WinRM, NetExec, Mimikatz, and the dumping of LSASS memory and NTDS.dat files. The actors also staged and exfiltrated large volumes of sensitive data to cloud storage services like Wasabi using the Rclone tool.
The final stage of the intrusion involved the deployment of The Gentleman ransomware. Prior to encryption, the attackers took steps to disable security measures, including Microsoft Defender protections, adding antivirus exclusions, stopping virtual machines, deleting shadow copies, clearing event logs, and removing forensic artifacts. The ransomware was then deployed domain-wide through a malicious Group Policy Object (GPO), executing staged ransomware binaries from SYSVOL/NETLOGON via scheduled tasks. This resulted in widespread encryption of systems, the dropping of ransom notes, and the modification of desktop backgrounds.
