Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization Research

Analysis of a server infrastructure revealed a complete TukTuk C2 framework (version 2.0) with cross-platform capabilities, including Windows and Linux agents, backend infrastructure, and a management panel. The server contained the eb.sys component matching the GentleKiller malware and comprehensive EDR neutralization training materials organized into four lessons covering BYOVD techniques, vulnerable driver hunting, and kernel-level research. DLL sideloading configurations were found targeting Greenshot, ProcMon, Slack, and Postman. Exfiltrated data included 224 Jira tickets from a global technology company related to U.S. defense organizations and contractors, plus credentials from a global healthcare company's Infrastructure-as-Code platform exposing AWS keys, production databases, Azure AD, and Bitbucket access. The threat actor is identified as The Gentlemen. There are no known exploits in the wild and no patches or fixes are applicable as this is a malware framework and research disclosure rather than a software vulnerability.

The threat actor's use of the TukTuk C2 framework enables cross-platform control over compromised systems, including advanced EDR neutralization techniques that may evade detection. The exfiltration of sensitive Jira tickets related to U.S. defense organizations and contractors poses a significant risk to national security and defense-related intellectual property. Additionally, the compromise of credentials for cloud infrastructure and production environments of a global healthcare company could lead to unauthorized access, data breaches, and potential disruption of critical healthcare services. The presence of DLL sideloading targeting trusted applications increases the likelihood of stealthy persistence and lateral movement within victim networks.

No official patches or fixes are applicable as this is a malware framework and research disclosure. Organizations should focus on detection and prevention strategies specific to the techniques described, such as monitoring for DLL sideloading attempts, suspicious driver loading, and unusual network communications associated with the TukTuk C2 framework. Employing behavioral EDR solutions capable of detecting BYOVD and kernel-level exploitation techniques may help mitigate risk. Review and tighten access controls for cloud infrastructure and production environments to limit exposure from compromised credentials. Incident response teams should investigate any indicators of compromise related to the provided hashes and domain names.