Security researchers have uncovered a newly observed framework called “TukTuk” being used in ransomware operations. It serves as a remote-control tool to steal credentials, monitor compromised machines, and dismantle security mechanisms as part of a broader attack strategy.
TukTuk has been tied to the Gentlemen (aka GentleKiller) ransomware group. Its discovery reveals a fully assembled toolkit: Windows and Linux agents, a backend infrastructure, an operator panel, and support tools built for disabling endpoint protections. This suggests attackers are ready to move past initial compromise toward exfiltration and encryption phases. The findings also give incident responders several actionable traces to work from. (Date of report: September 2, 2026)
What TukTuk Can Do
The Windows component of TukTuk can gather system metadata, run arbitrary commands, manage files, take screenshots, and communicate with its command-and-control (C2) panel. A separate Linux agent implies the threat actor can target mixed environments. One key feature allows operators to trigger a counterfeit Windows Security prompt to phish credentials directly from users.
A sideloading attack was also found: the legitimate Greenshot.exe program was used with a malicious log4net.dll in its directory. This technique lets an attacker load the DLL when the trusted app is run, hiding malicious behavior behind routine software.
EDR Disabling, Documentation & Victim Exposure
TukTuk’s infrastructure included training materials focused on defeating endpoint detection and response (EDR) tools using driver-based attacks—components such as eb.sys, and tools dubbed EDRKiller, WarsawKiller, and UnknownKiller all surfaced. These tools enable control over low-level drivers, giving attackers deep hooks into the system to cripple defenses before ransomware is deployed.
Evidence points to real-world damage: data from two major organizations—one in technology, one in healthcare—has been exfiltrated. That includes Jira ticket records tied to defense-industry customers, cloud credentials, production databases, and configuration data for AWS, Azure AD, and Bitbucket.
Indicators & Defensive Strategies
Key indicators of compromise (IoCs) include IP 65.109.70.162, a domain borjumaniya.store, driver and executable hashes such as eb.sys, TukTuk.exe, and others tied to the malicious log4net.dll and the ZIP archive tuktuk-v2.0_10.zip.
Organizations can harden against TukTuk by enforcing driver allowlisting, using Microsoft’s Vulnerable Driver Blocklist, and vigilantly monitoring for abnormal DLL loading, unexpected credential prompts, and unauthorized screen captures or remote commands. Rotating credentials, auditing cloud logs, reviewing ticketing systems for unexpected downloads, and containing compromised hosts are all advised.
Incident investigators shared findings with affected entities. Experts emphasize cross-team cooperation among security operations centers, identity teams, and cloud managers as essential to limiting damage and blocking repeated intrusion attempts.
What this Means. TukTuk represents a significant escalation in ransomware group capabilities—moving beyond encryption toward the integration of surveillance, credential theft, and strategic defense suppression. This modular, cross-platform framework is likely to become a more common tool in big-cohort hacking operations. Organizations should take this as a prompt not just to revisit perimeter security, but also to reinforce identity protection, driver integrity, and internal visibility. Vigilance on early signals—phishy prompts, odd driver loads, strange domains, or sudden infrastructure changes—can make the difference between preventing a breach and suffering full-scale compromise.
