Ransomware Operators Linked to The Gentlemen Deploy TukTuk C2 Framework for Espionage and Credential Theft
Operators linked to the The Gentlemen ransomware are using a new command-and-control framework called TukTuk to steal credentials, monitor compromised machines, and prepare environments for ransomware attacks.
The framework was identified on a server that also stored tools for disabling EDR solutions, research on vulnerable drivers, and data apparently stolen from two large organizations. TukTuk features agents for both Windows and Linux, as well as its own backend and management panel. The structure allows operators to execute commands remotely, transfer files, capture screens, and track compromised devices from a single interface.
One of the capabilities displays a fake Windows Security window on the victim's computer. Credentials entered into this form are sent directly to the attackers' controlled panel. Researchers also discovered a DLL sideloading technique that uses the legitimate Greenshot.exe executable to load a malicious log4net.dll library and start the TukTuk agent on the system.
The server contained additional tools such as EDRKiller, WarsawKiller, and UnknownKiller, along with materials on BYOVD attacks. This technique uses legitimate but vulnerable drivers to obtain kernel access and interfere with security products.
Among the exposed data were 224 Jira tickets and eight attachments belonging to a global technology company, as well as credentials related to AWS, Azure AD, Bitbucket, and databases of a healthcare organization.
Related articles
PAYLOAD Ransomware Seizes Active Directory GPO to Disrupt Entire Windows Domain Without Encryption
Researchers at Kaspersky have documented an attack by the PAYLOAD ransomware that paralyzes an entire Windows domain without encrypting a single file. Instead of encryption, the operators leverage native Windows policy mechanisms to enforce disruption across the environment. The core of the attack is a malicious Group Policy Object named PAYLOAD linked directly to the root of the Active Directory domain. This placement allows the policy to reach virtually every connected device, turning it into a corporate-wide disruption tool. Through the GPO, the group distributes ransom notes from SYSVOL, replaces wallpapers and lock screens with extortion images displaying the message Welcome to Payload, and disables local administrator accounts on affected machines. A second policy object named win Firewall Off disables the Windows firewall across the entire fleet, increasing exposure during the operation. Initial access occurred in April 2026 via a compromised legitimate domain account on a FortiGate SSL VPN, with possible entry vectors including phishing, password spraying, and credential stuffing. The victim is a manufacturing company in the Middle East. The extortion model combines data theft with operational shutdown, delivering effects similar to traditional ransomware but without any decryption key to negotiate.
Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption
Kaspersky researchers have uncovered a new extortion campaign called Payload that targets manufacturing companies by compromising privileged accounts and seizing control of Active Directory. Instead of deploying traditional ransomware encryptors, the attackers created a Group Policy Object named Payload linked to the domain root. This GPO automatically changed desktop wallpapers and lock screens across all systems, displayed ransom demands, and disabled administrative accounts after policy refresh. The group also exfiltrated valuable corporate data before the lockdown and later published it on the dark web to increase pressure on victims. Because the attack relied entirely on legitimate Windows mechanisms such as VPN access and Group Policy, conventional antivirus solutions proved ineffective. Experts recommend monitoring GPO changes, enforcing phishing-resistant MFA on VPN and admin systems, and applying least-privilege principles to limit the impact of credential compromise.
SETTRA Ransomware Deploys MeshAgent and gdrv.sys BYOVD Against Windows Systems
Huntress analysts have identified two separate incidents involving the newly observed SETTRA ransomware targeting Windows environments. The attacks combined the legitimate MeshAgent remote management tool with a Bring Your Own Vulnerable Driver technique using gdrv.sys to disable security controls. Victims included a consumer services and retail company hit in July and an industrial organization compromised in September. Initial access occurred through VPN connections or previously stolen credentials, after which operators deployed MeshAgent to maintain persistence and execute commands. Before encryption, the group deleted Windows event logs, disabled system recovery features, removed recovery partitions, and overwrote free disk space. Encrypted files received the .locked or .locked_wip extensions, with the ransomware binary named after the victim domain and ransom notes dropped as RESTORE_FILES.txt.
Ukrainian Developer of LockerGoga, MegaCortex and Nefilim Ransomware Sentenced to 12 Years and Nine Months
A 52-year-old Ukrainian national has been sentenced by the Zurich District Court to 12 years and nine months in prison for his role as the lead developer of the LockerGoga, MegaCortex and Nefilim ransomware strains. The court determined that the malware he created was deployed against companies across dozens of countries, causing approximately 100 million Swiss francs in damages in the cases examined. Notable victims included train manufacturer Stadler Rail, which suffered the theft of around 500 GB of confidential data and a $6 million ransom demand in 2020, as well as climate equipment supplier Meier Tobler and banking software developer Crealogix. The defendant claimed he was performing ordinary cybersecurity consulting and was unaware of the intended use of his code, but investigators found ransom demand templates alongside the source code, undermining his defense. He has been in custody since October 2021 as part of a wider international investigation into attacks affecting more than 1,800 individuals and organizations in 71 countries. Upon release he will be banned from entering Switzerland for ten years, although the verdict remains subject to appeal.