Loading story…
Oasis Security identified TukTuk, a previously undocumented cross-platform command-and-control framework linked to the Gentlemen ransomware ecosystem. Its Windows and Linux agents, backend, and operator panel support remote command execution, file management, host reconnaissance, screenshot capture, and credential harvesting through a fake Windows Security prompt—enabling operators to surveil victims and prepare systems for data theft and ransomware deployment.
Researchers found TukTuk on an infrastructure server alongside DLL-sideloading components, EDR-disabling utilities, vulnerable-driver research, and artifacts associated with Bring Your Own Vulnerable Driver (BYOVD) techniques. Identified files include TukTuk.exe, UnknownKiller.exe, Greenshot.exe, eb.sys, and wsftprm.sys; associated network indicators include 65.109.70.162 and borjumaniya.store. The server also reportedly held data exfiltrated from a global technology company and a healthcare organization, indicating an operational environment built to steal credentials, suppress endpoint defenses, and stage ransomware intrusions.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers stated that they shared the relevant TukTuk investigation findings with affected organizations and institutions.
Researchers recovered TukTuk from a Hetzner-hosted server at 65.109.70.162 that also contained a Greenshot DLL-sideloading package, EDR-disabling tools, vulnerable-driver research materials, and artifacts including eb.sys and wsftprm.sys. The server reportedly held 224 Jira tickets and eight attachments from an unnamed global technology company, plus cloud and infrastructure credentials associated with an unnamed healthcare organization; borjumaniya.store appeared in the malicious DLL's embedded C2 configuration.
Oasis Security identified TukTuk, a previously undocumented command-and-control framework assessed as linked to the Gentlemen ransomware ecosystem. The recovered project included Windows and Linux agents, a backend service, and an operator panel supporting command execution, file management, system-data collection, screenshots, and credential harvesting through a fake Windows Security prompt.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Researchers at InfoGuard identified a new Python-based backdoor, **ViperTunnel**, inside UK and US business networks, where it appears to provide persistent access that can later be sold or handed off to ransomware operators including **RansomHub**. The malware was uncovered during incident response to a **DragonForce** ransomware attack and is frequently seen after **FAKEUPDATES** (`SocGholish`) infections. Reporting also says ViperTunnel is often used alongside the **ShadowCoil** credential stealer, strengthening its role in broader intrusion chains that move from initial compromise to credential theft and eventual ransomware deployment. ViperTunnel disguises itself as a DLL but is actually a heavily obfuscated Python script that abuses Python's `sitecustomize.py` auto-loading mechanism for execution and persistence, including via suspicious Windows scheduled tasks. It establishes a **SOCKS5** proxy over port `443` to blend malicious traffic with normal web activity, while layered obfuscation and encryption hinder analysis. InfoGuard said the malware has evolved from error-filled early builds into a more modular framework and assessed it is likely linked to **UNC2165**, a cluster associated with **EvilCorp**; researchers also found Linux anti-debugging artifacts, including a `TracerPid` check, indicating the operators may be preparing a future cross-platform version targeting Linux systems.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026