TukTuk Locker Ransomware Targets Credentials, Disables Security

Key Takeaways

• A previously unknown remote-control framework, dubbed “TukTuk,” has been discovered in use by ransomware operators, specifically linked to the Gentlemen ransomware group.
• TukTuk facilitates credential theft, system surveillance, and the disabling of security tools on compromised Windows and Linux machines.
• The framework’s discovery provides unusual insight into the sophisticated infrastructure and preparatory stages behind modern ransomware attacks, including pre-staged attack environments and detailed EDR evasion training materials.
• Organizations in the technology and healthcare sectors, particularly those with US defense industry connections, appear to be primary targets, with sensitive data already exfiltrated.

Ransomware Hackers Deploy New TukTuk Malware

Ransomware groups are leveraging a sophisticated, previously undetected remote-control framework named TukTuk to infiltrate systems, exfiltrate credentials, monitor compromised environments, and systematically neutralize security defenses. This discovery directly connects the new tool to the activities of the notorious Gentlemen ransomware operation, revealing a multi-faceted approach that integrates credential harvesting, pervasive surveillance, and advanced evasion tactics within a single intrusion.

The retrieval of the complete TukTuk framework provides an uncommon glimpse into the operational infrastructure and extensive research underpinning a modern ransomware enterprise. Security researchers at Oasis Security successfully identified the entire project, encompassing both Windows and Linux agents, a robust backend system, and a dedicated operator panel.

The framework was found on a server that also contained a malicious DLL sideloading kit, tools designed to disable Endpoint Detection and Response (EDR) solutions, and data believed to have been stolen from two major organizations. This combination strongly indicates a meticulously prepared attack environment, designed to transition seamlessly from an initial breach to data exfiltration and, ultimately, ransomware deployment. The breadth of these findings also presents incident responders with numerous distinct indicators to investigate, complicating containment efforts and heightening the risk of subsequent intrusions.

Oasis Security said in a report shared with Cyber Security News (CSN) that their investigation uncovered 224 Jira tickets and eight attachments, which are believed to have been exfiltrated from a global technology company. Additionally, cloud and infrastructure credentials linked to a healthcare organization were found. The potential impact of this exposure extends beyond immediate victims. The Jira records reportedly contained technical data related to US defense and defense-industry clients, while the healthcare information included credentials for AWS, Azure AD, Bitbucket, production databases, and critical configuration systems. This suggests the threat actors are actively accumulating intelligence for future access, extortion, or follow-on attacks, significantly increasing the potential cost of a single system compromise.

TukTuk’s Operational Capabilities

TukTuk functions as a comprehensive command-and-control (C2) framework, enabling threat actors to centrally manage infected devices. Its Windows agent is capable of gathering detailed system information, communicating with the C2 server, executing arbitrary commands, managing files, and capturing screenshots. The existence of a distinct Linux agent highlights a deliberate cross-platform design, a critical consideration for organizations operating diverse server and workstation environments.

A particularly insidious feature of the operator panel is its direct credential-theft mechanism. Attackers can trigger a fabricated Windows Security prompt that closely mimics the legitimate interface. Any information entered by the user into this fake prompt is then recorded and transmitted back to TukTuk. This transforms a compromised endpoint into an active password-collection instrument, moving beyond mere technical exploits to social engineering at the user interface level. This discovery builds upon previous research concerning GentleKiller ransomware’s defense evasion strategies, which detailed the same ransomware ecosystem utilizing vulnerable drivers to deactivate endpoint security measures. TukTuk enhances this by introducing a broader control layer for tracking agents, monitoring commands, capturing screenshots, and stealing credentials prior to the final encryption phase.

Researchers also identified a sideloading package that leverages the legitimate Greenshot.exe application to load a malicious log4net.dll. This technique, where a trusted application is coerced into loading an attacker-controlled library from its own directory, mirrors patterns observed in recent DLL sideloading campaigns that disguise malicious code within seemingly normal software operations.

Security Tools Were a Deliberate Target

The compromised server contained extensive training materials organized into four distinct lessons focused on neutralizing EDR products and identifying vulnerable drivers. The materials included `eb.sys`, a driver whose hash corresponds to a publicly documented GentleKiller sample, alongside EDRKiller, WarsawKiller, and UnknownKiller tools. These documents indicate that the threat actors meticulously studied the recovery times of security protections after process termination, demonstrating a deep understanding of EDR mechanics.

Exploiting vulnerable drivers grants attackers profound control over Windows systems, allowing them to interfere with security software before ransomware is deployed. Organizations can mitigate this risk by strictly enforcing driver allowlisting, enabling Microsoft’s Vulnerable Driver Blocklist, and thoroughly investigating any unexpected driver installations or kernel-level service creations. The consistent reporting on ransomware EDR killer tactics underscores that these methods are persistent and evolving ransomware strategies. Defenders should also be vigilant for legitimate programs loading unusual DLLs from nearby directories, unexpected credential prompts, and unexplained screen-capture or remote-command activities. DLL sideloading can make malicious processes appear routine, as demonstrated by the related Mistic credential theft campaign, emphasizing the importance for endpoint security teams to scrutinize suspicious DLL-to-process relationships rather than relying solely on file names.

What You Should Do

• Rotate Credentials: Immediately rotate all potentially exposed credentials, especially those for cloud services, infrastructure, and critical applications.
• Review Cloud Logs: Conduct a thorough audit of cloud logs (AWS, Azure AD, etc.) for any suspicious activity, unauthorized access, or unusual data transfers.
• Inspect Collaboration Platforms: Check Jira and similar collaboration platforms for unauthorized access, unusual downloads of sensitive information, or the presence of secrets.
• Implement Driver Allowlisting: Enforce strict driver allowlisting policies and enable Microsoft’s Vulnerable Driver Blocklist to prevent the loading of malicious or compromised drivers.
• Monitor DLL Loading: Actively monitor and investigate legitimate applications loading unusual or unexpected DLLs from their respective directories.
• Educate Users: Train users to recognize and report suspicious credential prompts, as the TukTuk framework employs fake Windows Security prompts for credential theft.
• Hunt for IoCs: Actively hunt across both Windows and Linux environments for the provided Indicators of Compromise (IoCs).
• Isolate and Preserve: Isolate any suspected hosts immediately upon detection and preserve all evidence for forensic analysis.
• Coordinate Response: Ensure rapid and effective coordination between security, identity, and cloud operations teams during incident response.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.