EtherRat and TukTuk Malware Campaigns Lead to The Gentleman Ransomware

The EtherRat malware, initially identified in late 2025 targeting Linux servers via a React2Shell vulnerability, has evolved. A Windows variant emerged in early 2026, with investigations revealing earlier activity. These campaigns, alongside the TukTuk C2, have now been linked to the deployment of The Gentleman ransomware.