A ransomware toolkit exposed from the inside

Researchers have uncovered a previously undocumented remote-control framework called TukTuk in infrastructure associated with the Gentlemen ransomware ecosystem. The recovered server contained far more than a single payload: investigators found Windows and Linux agents, a backend and operator panel, malicious DLL sideloading components, tools intended to disable endpoint protection, and information believed to have been stolen from two large organizations.

That collection provides a rare look at the preparation behind a ransomware operation. It suggests an environment designed to move from surveillance and credential theft to defense evasion, data collection, and eventual encryption or extortion. The presence of material from multiple victims also raises the prospect of follow-on access, because stolen cloud credentials and internal technical records can remain useful long after the first endpoint is contained.

TukTuk combines control, surveillance, and credential theft

Oasis Security analysts said TukTuk's Windows component can inventory a system, communicate with its command server, execute commands, transfer files, and capture screenshots. A separate Linux agent extends coverage into mixed workstation and server environments. Operators manage infected systems through a centralized panel, allowing them to track hosts and issue actions during an intrusion.

One particularly direct feature can display a fake Windows Security prompt and record credentials entered by the victim. That turns an already compromised computer into a social-engineering platform: the request appears to come from the operating system rather than an email or web page. The attacker can then reuse captured credentials against internal services, cloud consoles, or neighboring machines. Defenders should treat unexpected authentication prompts on active sessions as a potential post-compromise signal, not merely a user-support issue.

Security controls were an explicit target

The exposed server included EDRKiller, WarsawKiller, UnknownKiller material, driver files, test scripts, and a four-lesson training collection about neutralizing endpoint detection and response products. Researchers also identified eb.sys, whose hash matched a publicly documented GentleKiller sample. Such bring-your-own-vulnerable-driver tactics abuse a legitimate but flawed kernel driver to obtain powerful access and interfere with security processes.

Investigators also found a sideloading package in which the legitimate Greenshot.exe application loaded a malicious log4net.dll placed beside it. DLL sideloading helps hostile code inherit the appearance of a trusted program and can bypass controls that rely too heavily on filenames or signatures. Together, the driver tooling and sideloading package show deliberate work to suppress defenses before ransomware deployment rather than opportunistic use of a single evasion trick.

Stolen enterprise data broadens the risk

The server reportedly held 224 Jira tickets and eight attachments linked to a global technology company, including information connected with US defense customers. Credentials tied to a healthcare organization reportedly covered AWS, Azure AD, Bitbucket, production databases, and configuration systems. If valid, those artifacts could enable cloud intrusion, source-code theft, supply-chain access, or additional extortion.

Potentially exposed organizations should rotate credentials, revoke active sessions, review cloud and source-control logs, and search project-management systems for secrets and unusually broad downloads. Endpoint teams should investigate unexpected kernel-driver installation, service creation, screen capture, suspicious credential dialogs, and trusted programs loading unusual local DLLs. Microsoft’s Vulnerable Driver Blocklist and application control can narrow the opportunity for driver abuse. Responders should hunt across both Windows and Linux estates, isolate affected hosts, preserve evidence, and coordinate identity, endpoint, and cloud containment before restoring systems.

Practical security takeaway

This event also underlines the importance of layered controls and rehearsed incident response. Organizations should document ownership for identity, endpoint, cloud, and developer tooling; retain the telemetry needed to connect activity across those systems; and test containment procedures before an emergency. Security teams should translate vendor guidance into measurable checks rather than treating an update or configuration change as the end of the investigation. Where exposure is possible, defenders should establish a time window, identify affected assets and accounts, preserve relevant evidence, and verify that remediation actually removed persistence. Users and administrators should rely on official update channels, avoid unverified fixes, and report suspicious behavior promptly. These steps cannot eliminate every attack path, but they reduce both the likelihood that an initial foothold succeeds and the damage an intruder can cause after gaining access.