Executive Summary
Analysis of a Finland-based server (65.109.70[.]162) has revealed the complete project structure for the TukTuk C2 framework, a previously undocumented cross-platform toolkit used by the threat actor group known as 'The Gentlemen'. The server contained not only attack infrastructure but also extensive training materials for Bring Your Own Vulnerable Driver (BYOVD) techniques, specifically designed to neutralize EDR solutions through kernel-level manipulation.
The technical findings demonstrate a sophisticated attack chain involving DLL sideloading via legitimate applications like Greenshot and the deployment of specialized EDR-killing drivers such as eb.sys (GentleKiller). The group has successfully exfiltrated 224 Jira tickets from a global technology firm, compromising sensitive data related to U.S. defense and aerospace sectors, alongside administrator-level cloud credentials from a global healthcare provider's Infrastructure-as-Code (IaC) platform.
This activity represents a significant risk to critical infrastructure and defense industrial base sectors. The group's use of AI-assisted development and structured research into zero-day driver vulnerabilities suggests an evolving capability to bypass modern endpoint protection and maintain long-term persistence in complex enterprise environments.
Key Details
Threat Name
TukTuk C2 Framework
Affects
log4net.dll, Greenshot.exe
Adversary
The Gentlemen Other Adversaries and Aliases: Lazarus Group; BlackByte; AvosLocker; Cuba ransomware
Malware/Tools
TukTuk C2, GentleKiller, UnknownKiller, WarsawKiller, EDRKiller, EtherRAT