EtherRAT, TukTuk Chain Delivers Gentlemen Ransomware
An intrusion using EtherRAT and the AI-generated TukTuk backdoor abused Ethereum, Arweave, and SaaS platforms for C2 before deploying The Gentlemen ransomware domain-wide.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-55182 as exploited in the wild.
The DFIR Report details an April intrusion linked to a broader EtherRAT campaign first documented by Sysdig (exploiting CVE-2025-55182/React2Shell on Linux) and later observed on Windows by Atos. Initial access came from a malicious MSI masquerading as the Sysinternals RAMMap utility, which deployed an EtherRAT variant using "EtherHiding" — querying Ethereum smart contracts via 1rpc.io — to dynamically fetch C2 configuration, including decoy domains meant to confuse defenders and later pivoting to a TryCloudflare tunnel once the actor activated live infrastructure.
The intrusion escalated with deployment of TukTuk, a newly identified, reportedly AI-generated malware framework delivered via DLL sideloading disguised as legitimate tools (Greenshot, SyncTrayzor, DocFX, Cake). TukTuk established C2 through SaaS platforms including ClickHouse and Supabase, with fallback channels over Ably, Dropbox, GitHub Issues, and an Arweave-based dead-drop resolver capable of retrieving encrypted multi-transport credential blobs. The actor then conducted Kerberoasting, LSASS/NTDS credential dumping, and broad AD reconnaissance, before using compromised service accounts to deploy the GoTo Resolve RMM tool laterally across servers and domain controllers.
Over several days the actor moved via RDP, SMB, WinRM, and NetExec, dumped credentials with Mimikatz, and exfiltrated large volumes of data using Rclone to Wasabi cloud storage. The intrusion culminated in domain-wide deployment of The Gentlemen ransomware via a malicious Group Policy Object executing staged binaries from SYSVOL/NETLOGON, preceded by Defender tampering, shadow copy deletion, and log clearing. The campaign's reliance on decentralized blockchain infrastructure (Ethereum, Arweave) alongside legitimate SaaS and RMM platforms provides notable resilience against conventional network-based defenses; Supabase, ClickHouse, and GoTo assisted in taking down related infrastructure.
Mentioned in this report
Source reporting: https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs