Threat reportRansomwareTL-2026-3930
EtherRAT and TukTuk C2 lead to The Gentleman ransomware (malicious MSI posing as Sysinternals RAMMap)
EtherRAT and TukTuk C2 lead to The Gentleman ransomware (TL-2026-3930), also tracked as EtherRAT Windows variant, is a high-severity ransomware operation, first published 2026-10-20. It is attributed to The Gentlemen with medium confidence, affects Microsoft Windows (endpoints and Active Directory domain environments), maps to 19 MITRE ATT&CK techniques (T1003.001, T1003.003, T1021.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1The Gentlemen
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3930
- Threat ID
- TL-2026-3930
- Also known as
- EtherRAT Windows variant, TukTuk C2, The Gentleman ransomware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, it-services, health, finance, construction, logistics
- Target regions
- Global, brazil, china, indonesia, taiwan, thailand
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in EtherRAT and TukTuk C2 lead to The Gentleman ransomware
Malware and tooling: EtherRAT, MimiKatz, CloudFlare Tunnel, Rclone - S1040
How EtherRAT and TukTuk C2 lead to The Gentleman ransomware works
The DFIR Report documents an April 2026 intrusion that began with a user running a malicious MSI masquerading as Sysinternals RAMMap, which deployed a Windows EtherRAT variant using Ethereum (EtherHiding) for C2 configuration. Three days in, The Gentleman ransomware was deployed domain-wide through a malicious GPO, after credential theft, lateral movement and Rclone exfiltration to Wasabi.
Initial access occurred when a user executed a malicious MSI installer (RAMMap.msi) masquerading as the Sysinternals RAMMap utility. The MSI deployed a Windows variant of EtherRAT, a JavaScript RAT that runs under a downloaded Node.js runtime (node-v18.20.5-win-x64.zip fetched with curl from nodejs.org) and uses the Ethereum blockchain (EtherHiding, via the 1rpc.io RPC endpoint and two smart contracts) to dynamically update its C2 configuration. Persistence was set through an HKCU Run key value named AppResolver. EtherRAT first appeared against Linux in December 2025 via CVE-2025-55182 (React2Shell), and Atos reported the Windows variant campaign in March 2026 (44 spoofed GitHub repositories distributing fake admin tools). The CVE is only relevant to the earlier Linux campaign and is not part of this intrusion chain.
Over the following days the operators performed host and network discovery (SoftPerfect Network Scanner), Kerberoasting, LSASS dumping with comsvcs.dll via rundll32, and NTDS extraction with NetExec (nxc smb --ntds), and moved laterally over RDP, SMB and WinRM. They installed GoTo Resolve (smokymo.msi) as an unattended RMM service for redundant access and deployed TukTuk, an AI-generated malware framework delivered by DLL sideloading (a malicious log4net.dll; the intrusion also saw sideloading through Greenshot, SyncTrayzor, DocFX and Cake). TukTuk uses SaaS platforms (ClickHouse and Supabase as primary channels; Ably, Dropbox, direct HTTP and GitHub Issues as backups) and can use Arweave as a dead-drop resolver for an encrypted configuration blob. TryCloudflare tunnel domains and the fallback HTTP C2 borjumaniya.store were also observed.
Data was exfiltrated with Rclone to Wasabi cloud storage (--max-age 2y, 16 transfers, 128 checkers). On day 3 The Gentleman ransomware was deployed: Microsoft Defender was disabled and AV exclusions added, virtual machines stopped, shadow copies deleted, event logs cleared, and a malicious GPO executed staged ransomware binaries from SYSVOL/NETLOGON through scheduled tasks. Kaspersky Securelist describes The Gentlemen as a RaaS group (first seen mid-2025) with Go (Curve25519/XChaCha20) and C (AES-256-GCM/RSA) encryptors that works with initial access brokers. The DFIR Report names no threat actor for this intrusion; the ransomware family attribution is to The Gentlemen group.
MITRE ATT&CK techniques used in TL-2026-3930
Credential Access
T1003.001 LSASS Memory; T1003.003 NTDS; T1558.003 Kerberoasting
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Execution
T1053.005 Scheduled Task; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1102.001 Dead Drop Resolver; T1102.002 Bidirectional Communication; T1219 Remote Access Tools
Defense Evasion
T1218.007 Msiexec; T1574.001 DLL
defense-impairment
T1484.001 Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Impact
Persistence
T1547.001 Registry Run Keys / Startup Folder
Exfiltration
Affected products and versions in EtherRAT and TukTuk C2 lead to The Gentleman ransomware
- Microsoft — Windows (endpoints and Active Directory domain environments)
Vulnerable versions: Not version-specific; abuse of user execution, credentials and Group Policy
Remediation for EtherRAT and TukTuk C2 lead to The Gentleman ransomware
Immediate actions
- Block or alert on the listed C2 domains (trycloudflare.com tunnels, Supabase, ClickHouse Cloud hosts, borjumaniya.store) and on 1rpc.io RPC traffic from non-blockchain endpoints
- Hunt for HKCU Run value AppResolver, node.exe running from user AppData/Temp, and GoToResolve unattended services not deployed by IT
- Reset krbtgt and service-account credentials if Kerberoasting, LSASS or NTDS access is suspected
- Audit GPOs and SYSVOL/NETLOGON for newly created policies, scheduled tasks and unknown binaries
Workarounds
- Application control (WDAC/AppLocker) to block unsigned MSI/DLL sideloading from user-writable paths
- Block outbound access to unapproved RMM domains (gotoresolve.com) and tunnel services
Longer-term hardening
- Restrict software installation to approved sources; block user-run MSI from untrusted origins and spoofed admin-tool downloads
- Alert on egress to Wasabi and other unsanctioned cloud storage and on Rclone usage
- Enable LSASS protection (RunAsPPL/Credential Guard) and use long random passwords or gMSAs for service accounts
- Maintain offline, tested backups and restrict who can create or link GPOs
Timeline of EtherRAT and TukTuk C2 lead to The Gentleman ransomware
- EtherRAT first reported (December 2025) targeting Linux via CVE-2025-55182 (React2Shell); exact day not stated in the source.
- Atos reported a Windows EtherRAT variant campaign (March 2026) with activity traced back to the previous December; exact day not stated.
- April 2026 intrusion begins when a user runs a malicious MSI masquerading as Sysinternals RAMMap, deploying EtherRAT (exact day not stated).
- Within the first days the operators perform reconnaissance, credential theft (Kerberoasting, LSASS, NTDS), lateral movement, install GoTo Resolve, deploy TukTuk and exfiltrate data with Rclone to Wasabi; day-level dating approximated from 'days 1-3' in the report.
- On day 3 of the intrusion The Gentleman ransomware is deployed via a malicious GPO after Defender is disabled, VMs stopped, shadow copies deleted and logs cleared; date approximated as April 2026 + 3 days.
- The DFIR Report publishes the flash alert with 44 domains, 2 Ethereum contracts, 1 Arweave Drive-Id and 8 file hashes.
- AttackIQ publishes an emulation of The Gentlemen ransomware.
Sources cited for EtherRAT and TukTuk C2 lead to The Gentleman ransomware
- Flash Alert: EtherRAT and TukTuk C2 End in The Gentleman Ransomware
- Gurucul: Flash Alert - EtherRat and TukTuk C2 End in The Gentleman Ransomware
- Kaspersky Securelist: The Gentlemen RaaS
- Oasis Security: The Gentlemen Ransomware Group's TukTuk Framework
- Infosecurity Magazine: EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts
- Aviatrix: EtherRAT distribution spoofing administrative tools via GitHub facades
- AttackIQ: Emulating the Gentlemen Ransomware
- CSO Online: The Gentlemen are coming for your files and then your network
Detection coverage for TL-2026-3930
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3930 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3930
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.