# EtherRAT and TukTuk C2 lead to The Gentleman ransomware (malicious MSI posing as Sysinternals RAMMap)

> The DFIR Report documents an April 2026 intrusion that began with a user running a malicious MSI masquerading as Sysinternals RAMMap, which deployed a Windows EtherRAT variant using Ethereum (EtherHiding) for C2 configuration. Three days in, The Gentleman ransomware was deployed domain-wide through a malicious GPO, after credential theft, lateral movement and Rclone exfiltration to Wasabi.

- **Published:** 2026-10-20T05:42:47Z
- **Last reviewed:** 2026-10-20T05:42:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3930
- **ID:** TL-2026-3930
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Initial access occurred when a user executed a malicious MSI installer (RAMMap.msi) masquerading as the Sysinternals RAMMap utility. The MSI deployed a Windows variant of EtherRAT, a JavaScript RAT that runs under a downloaded Node.js runtime (node-v18.20.5-win-x64.zip fetched with curl from nodejs.org) and uses the Ethereum blockchain (EtherHiding, via the 1rpc.io RPC endpoint and two smart contracts) to dynamically update its C2 configuration. Persistence was set through an HKCU Run key value named AppResolver. EtherRAT first appeared against Linux in December 2025 via CVE-2025-55182 (React2Shell), and Atos reported the Windows variant campaign in March 2026 (44 spoofed GitHub repositories distributing fake admin tools). The CVE is only relevant to the earlier Linux campaign and is not part of this intrusion chain.

Over the following days the operators performed host and network discovery (SoftPerfect Network Scanner), Kerberoasting, LSASS dumping with comsvcs.dll via rundll32, and NTDS extraction with NetExec (nxc smb --ntds), and moved laterally over RDP, SMB and WinRM. They installed GoTo Resolve (smokymo.msi) as an unattended RMM service for redundant access and deployed TukTuk, an AI-generated malware framework delivered by DLL sideloading (a malicious log4net.dll; the intrusion also saw sideloading through Greenshot, SyncTrayzor, DocFX and Cake). TukTuk uses SaaS platforms (ClickHouse and Supabase as primary channels; Ably, Dropbox, direct HTTP and GitHub Issues as backups) and can use Arweave as a dead-drop resolver for an encrypted configuration blob. TryCloudflare tunnel domains and the fallback HTTP C2 borjumaniya.store were also observed.

Data was exfiltrated with Rclone to Wasabi cloud storage (--max-age 2y, 16 transfers, 128 checkers). On day 3 The Gentleman ransomware was deployed: Microsoft Defender was disabled and AV exclusions added, virtual machines stopped, shadow copies deleted, event logs cleared, and a malicious GPO executed staged ransomware binaries from SYSVOL/NETLOGON through scheduled tasks. Kaspersky Securelist describes The Gentlemen as a RaaS group (first seen mid-2025) with Go (Curve25519/XChaCha20) and C (AES-256-GCM/RSA) encryptors that works with initial access brokers. The DFIR Report names no threat actor for this intrusion; the ransomware family attribution is to The Gentlemen group.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1218.007 Msiexec
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1053.005 Scheduled Task
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1558.003 Kerberoasting
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1567.002 Exfiltration to Cloud Storage
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1484.001 Group Policy Modification
- T1490 Inhibit System Recovery

## Sources

- [Flash Alert: EtherRAT and TukTuk C2 End in The Gentleman Ransomware](https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/)
- [Gurucul: Flash Alert - EtherRat and TukTuk C2 End in The Gentleman Ransomware](https://community.gurucul.com/articles/ThreatResearch/Flash-Alert-EtherRat-and-TukTuk-C2-End-12-5-2026)
- [Kaspersky Securelist: The Gentlemen RaaS](https://securelist.com/the-gentlemen-raas/120447/)
- [Oasis Security: The Gentlemen Ransomware Group's TukTuk Framework](https://oasis-security.io/blog/The-Gentlemen-Ransomware-Hacker-Groups-TukTuk-Framework)
- [Infosecurity Magazine: EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts](https://infosecurity-magazine.com/news/etherrat-bypass-security-ethereum)
- [Aviatrix: EtherRAT distribution spoofing administrative tools via GitHub facades](https://aviatrix.ai/threat-research-center/etherrat-distribution-spoofing-administrative-tools-via-github-facades-2026)
- [AttackIQ: Emulating the Gentlemen Ransomware](https://www.attackiq.com/2026/05/22/gentlemen-ransomware/)
- [CSO Online: The Gentlemen are coming for your files and then your network](https://www.csoonline.com/article/4178580/the-gentlemen-are-coming-for-your-files-and-then-your-network.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3930