Inside The Gentlemen’s TukTuk C2 and EDR Evasion Lab

Why this disclosure is materially new

Earlier reporting on The Gentlemen largely documented real intrusions and leak-site activity. Research disclosed on September 1, 2026 instead exposes an operator-side work environment. Oasis Security’s analysis found the TukTuk C2 v2 development project, structured EDR-evasion research, and material assessed to have been collected from victim organizations on the same server. This connects tool development, defense testing, and stolen-data handling in a way that previous victim listings did not.

The evidence supports a focused conclusion: infrastructure linked to The Gentlemen was used as an integrated development and operations workspace. Defenders should look beyond a ransomware binary and reconstruct the relationship among initial execution, adaptive command and control, security-tool downtime, secret exposure, data theft, and encryption.

The TukTuk C2 v2 project

The exposed project contained four main components: Windows and Linux agents, a backend, and an operator panel. Analysts identified remote command execution and file-transfer capabilities, along with a feature that imitates a Windows security dialog to solicit usernames and passwords. That design shows a multi-platform control framework built to support both host management and follow-on credential access.

Artifacts also showed an AI coding assistant running with a tuktuk working directory and Russian-language prompts. Earlier assistant-session records aligned with backend and panel components recovered in the source project. The defensible interpretation is that an operator used a commercial coding assistant inside an iterative malware-development workflow.

Connection to an observed intrusion

The newly exposed environment matters because TukTuk had already appeared in a real intrusion documented by The DFIR Report in May. A user executed a malicious MSI masquerading as the Sysinternals RAMMap utility. The installer deployed an EtherRAT variant, a portable Node.js runtime, and obfuscated JavaScript, with persistence established through a registry Run key.

The malware queried configuration stored through the Ethereum blockchain. After the operator changed that configuration, communications shifted to a TryCloudflare tunnel. TukTuk and the GoTo Resolve remote-management tool then supported follow-on access, data was exfiltrated to a cloud service, and The Gentlemen ransomware was deployed.

The v2 source project adds a development dimension to that operational evidence. Monitoring should correlate endpoint execution, blockchain-gateway requests, first-seen tunnel domains, and remote-management activity on one timeline instead of relying on one static indicator.

A structured EDR-evasion curriculum

The same server held EDR-evasion material organized from Lesson 1 through Lesson 4. The progression moved from reviewing existing tools to implementation, vulnerable-driver discovery, and kernel-level research. Documentation and practice code accompanied the lessons, and material associated with the eb.sys driver—previously linked in public reporting to GentleKiller variants—appeared in the first stage.

Researchers also found measurements of how long major EDR processes took to recover after being forcibly terminated. A short protection gap can be used to run credential theft, load tooling, or deploy ransomware before the agent returns. Teams should compare service-stop and restart times with driver loads, process creation, credential access, and high-volume file activity.

Stolen data as an operations resource

The server contained 224 Jira tickets and eight attachments associated with a global technology company. An operator-created report sorted the material into 19 categories, including credentials, vulnerabilities, infrastructure, and customer communications. Support tickets can expose host names, device configuration, authentication problems, and restricted attachments, creating a map for additional targeting.

Another dataset included administrator-level cloud access keys and information related to databases, directory services, and source-code repositories. Incident response should map every exposed secret to its service and privilege scope, revoke it, issue a replacement, and inspect its use history.

Five defense priorities

First, verify the origin of MSI packages and scripts. Validate the signature, hash, and delivery path, and preserve the process tree when an installer launches a runtime such as Node.js and executes obfuscated content.

Second, investigate outbound activity as a sequence. Compare blockchain RPC access, first-seen tunnel domains, and unapproved remote-management tools on the same host. Time-align proxy, DNS, firewall, and EDR records.

Third, review historical EDR health. Look for driver loading, credential access, remote execution, or broad file reads between an abnormal agent stop and automatic recovery, and cross-check centrally collected telemetry.

Fourth, treat Jira, cloud, directory, and repository secrets as one exposure set. Revoke privileged keys first, inspect logins and API calls made with them, and reduce access to tickets or attachments containing internal configuration details.

Fifth, require evidence that reconnection and reinfection paths are closed. Watch for a host switching to another tunnel after blocking, confirm retired credentials are rejected, remove unauthorized remote tools and persistence before restoring backups, and continue monitoring for repeated EDR gaps or bulk file access.