The Gentlemen Ransomware Deployment via EtherRAT and TukTuk

In April 2026, a sophisticated intrusion attributed to threat actors using the EtherRAT and TukTuk malware frameworks culminated in the deployment of The Gentlemen ransomware. The attack began with an MSI installer masquerading as a Sysinternals utility, which delivered EtherRAT. This malware utilizes 'EtherHiding' techniques, querying the Ethereum blockchain (1rpc[.]io) to dynamically update its C2 configuration, making it highly resilient to traditional IP-based blocking.

Following initial access, the actor deployed TukTuk, an AI-generated malware framework, via DLL sideloading through legitimate applications like Greenshot and SyncTrayzor. The attackers moved laterally using GoTo Resolve RMM and NetExec, exfiltrated data via Rclone to Wasabi cloud storage, and finally executed domain-wide ransomware using malicious Group Policy Objects (GPOs). This campaign is notable for its heavy reliance on SaaS platforms (ClickHouse, Supabase) and blockchain technology for command-and-control, effectively blending with legitimate cloud traffic.

The business impact of such an attack is severe, involving both large-scale data theft and complete operational disruption through ransomware. The use of decentralized infrastructure and legitimate RMM tools necessitates that defenders monitor for unusual outbound connections to Web3 services and strictly audit the use of remote management software within their environments.