Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization Research

Overview

Analysis of server-side data associated with The Gentlemen identified the eb.sys file, along with materials related to TukTuk C2, DLL side-loading configurations, EDR neutralization, and vulnerable driver research.

Notably, the complete project structure of the TukTuk framework was identified, for which no prior public disclosure or documentation could be confirmed.

The same server also contained 224 Jira tickets and eight attachments assessed to have been exfiltrated from a global technology company's Jira environment, as well as credential and infrastructure-related information associated with a global healthcare company's Infrastructure-as-Code (IaC) Platform.

---

Executive Summary

• The eb.sys sample matched GentleKiller by hash
• The complete TukTuk C2 project was identified, including Windows Agent, Linux Agent, Backend, and Panel — indicating a cross-platform design
• Greenshot DLL sideloading configurations were identified, along with ProcMon, Slack, and Postman research
• Step-by-step materials covered EDR neutralization, BYOVD, vulnerable driver hunting, and kernel-level research
• 224 Jira tickets and eight attachments were exfiltrated from a global technology company, including data related to its U.S. defense and defense-industry customers
• Credentials and infrastructure data from a global healthcare company's IaC Platform were identified, including AWS, production databases, Azure AD, Bitbucket, and infrastructure configuration management

---

1. The Analyzed Server

Server Overview and Collection

The subject of this analysis is a single server detected by our threat intelligence service, AGATHA. All findings presented in this report are based on data collected from this server.

A set of files was collected from the server, and the subsequent analysis is based on this data.

Collected File Inventory

The collected data can be broadly divided into three categories.

This inventory serves as a map for the subsequent analysis, with each item examined in detail in the following sections. It shows that the server held (1) attack tools, (2) related research and training materials, and (3) exfiltrated data together in one place.

---

2. Attribution to The Gentlemen

The attribution of this server to The Gentlemen is based on multiple indicators found on the server that match existing public threat reports on The Gentlemen. The technical details of these indicators are covered in the TukTuk C2 Framework and EDR Neutralization sections; this section consolidates the basis for the attribution.

Indicator 1 — eb.sys hash match

The eb.sys file collected from the server matches, by its hash, the GentleKiller sample documented in public reports (SHA256: 97BD65E98CDC4E93D49EDD4EA905D43A61244DF0FD3323E6649330DE3B1BE091).

Indicator 2 — Greenshot DLL sideloading structure

The composition of the greenshot_sideload folder (legitimate Greenshot.exe + malicious log4net.dll) is consistent with the DLL sideloading technique known to have been used in The Gentlemen attack.

Static analysis of log4net.dll further identified TukTuk C2–related code and C2 configuration values, linking the sideloading set directly to the TukTuk framework.

Indicator 3 — TukTuk dashboard identifiers

The hostname DESKTOP-22EVPBQ and the operator identifier Neo, observed in the TukTuk C2 dashboard in screenshot2.png on the server, match information referenced in The Gentlemen's public report.

Referenced Public Sources

• The DFIR Report, "Flash Alert: EtherRAT and TukTuk C2 End in The Gentlemen Ransomware" (May 11, 2026)
• Related X (Twitter) post : https://x.com/evangeorgevoug/status/2038198328631193700

---

3. TukTuk C2 Framework

Identification

The TukTuk C2 was identified on the server through several artifacts: a dashboard screenshot, the executable, and indications of its development environment.

Dashboard

The TukTuk C2 management dashboard was found in screenshot2.png on the server. The dashboard displays connected agents along with their IP addresses, privilege levels, and operating system versions. (The hostname and operator identifier visible in this screenshot also match information in The Gentlemen's public report; this correspondence is treated as an attribution indicator in the Attribution to The Gentlemen section.)

TukTuk.exe

The executable TukTuk.exe and the compressed archive tuktuk-v2.0_10.zip were identified in the same path.

Based on its observed functionality, TukTuk.exe is assessed to facilitate access to and control of the TukTuk server; its login screen prompts for a server address, operator name, and password before connecting.

TukTuk.exe has a pre-existing submission history on VirusTotal and was flagged as malicious by 2 of 68 security vendors.

Development Environment

screenshot.png contained indications that the development of TukTuk C2 was carried out using artificial intelligence (AI).

Project Structure

The tuktuk-v2.0_10.zip archive was confirmed to have no prior public disclosure.

The archive is organized into four primary directories:

Collectively, these directories represent the complete project structure of the TukTuk C2 framework identified on the server.

Windows Agent

The tuktuk-agent directory contains the source code of the TukTuk Agent operating in a Windows environment.

The agent is executed on compromised systems, where it:

• Collects system information
• Communicates with the C2 server
• Executes commands delivered through the Panel

The source code is written in C# and corresponds to remote-control functionality provided through the Panel, including:

• File management
• Screen capture
• Command execution

Linux Agent

A separate tuktuk-agent-linux directory was identified.

The presence of a Linux agent, independent of the Windows agent, supports the assessment that TukTuk was developed to operate across multiple operating systems rather than being confined to the Windows environment.

Backend

The tuktuk-backend directory contains the backend component of the framework.

Analysis confirmed that the Backend processes agent connections according to Listeners created in the TukTuk Panel.

The Backend is responsible for functions related to:

• Agent status
• Command delivery
• Result reception

Panel

The tuktuk-panel directory contains the management interface.

Implemented in Node.js with Electron, it can be packaged and run as a Windows executable (.exe).

The Panel serves as the management interface for TukTuk C2, providing functionality to monitor connected agents and execute remote commands.

The logo, menu layout, and overall interface differ from previously documented versions of the TukTuk panel available in public sources.

Top-right menus

The top-right section of the TukTuk Panel contains:

• Servers
• Agents
• Processes
• Gallery
• Credential

Servers

The Servers menu provides access to the backend systems to which the agents are connected.

Agent

The Agent menu displays the list of compromised hosts connected to the TukTuk framework and their activation status.

Processes

The Processes menu enables remote control of processes running on compromised hosts.

Gallery

The Gallery menu displays screenshots saved from compromised hosts.

Credential

The Credential menu displays the list of credentials received from compromised hosts.

Top-left menus

The top-left section of the TukTuk Panel contains:

• Files
• Screenshot
• Cred Prompt
• Command Mode

Files

The Files menu enables the upload of files from the local system to compromised hosts.

Screenshot

The Screenshot menu enables the remote capture and storage of the current screen of connected compromised hosts.

Cred Prompt

The Cred Prompt menu elicits credentials by spoofing a Windows Security dialog.

Upon execution of the command, a window visually identical to the legitimate Windows Security interface appears on the compromised host.

Information entered by the user is recorded in the TukTuk framework.

Command Mode

The Command Mode menu provides predefined command shortcuts that enable an operator to remotely retrieve information from a compromised host.

Clicking Command Mode again activates Shell Mode, which displays shortcuts for commands available in the Windows environment.

In addition to these predefined options, the operator can directly enter and execute arbitrary commands on the compromised host.

DLL Sideloading via Greenshot

A malicious log4net.dll file known to have been used in the attack by The Gentlemen was identified.

The key files are:

• Legitimate Greenshot.exe
• Modified log4net.dll

The legitimate Greenshot executable loads the malicious log4net.dll from the same directory, thereby launching the TukTuk Agent.

The log4net.dll file has previously been submitted to VirusTotal and is currently detected as malicious by 17 vendors.

Static analysis of the malicious log4net.dll identified:

• Code associated with the TukTuk C2 framework
• Server addresses
• Configuration information
• Token-related information used for C2 communication

Identified services included:

• Slack
• GitHub
• Dropbox

Notably, both are the domain and the GitHub repository that were previously identified as C2 infrastructure in the analysis report published on X.

DLL Sideloading Research

A separate sideload-research directory was identified on the analyzed server.

The directory contains data analyzing and testing the potential for DLL sideloading targeting:

• Greenshot
• ProcMon
• Slack
• Postman

---

4. Analysis of Training and Research Materials on EDR Neutralization

Research materials on EDR neutralization and vulnerable drivers were identified on the server.

The materials were structured step-by-step from Lesson 1 to Lesson 4.

The collection progresses from learning the operating principles of existing EDR killers and proof-of-concept (PoC) BYOVD:

• Implementing live EDR neutralization tools
• Searching for new vulnerable drivers
• Researching kernel-level attack techniques

---

Lesson 1: GentleKiller and UnknownKiller

Identified materials include:

• eb.sys
• UnKnownKiller.c
• UnknownKiller.exe
• BYOCD_UnkownKiller.md

eb.sys has been analyzed in public reports as a driver associated with a variant of GentleKiller.

UnknownKiller source code and executable files utilizing the driver were identified.

A document describing BYOVD-based EDR neutralization was also included, explaining how protected processes are accessed and terminated using the eb.sys driver.

---

Lesson 2: EDRKiller and WarsawKiller

Identified materials include:

• EDRKiller
• WarsawKiller
• LESSON2_EDR_vs_BYOVD.md

The materials include educational content for understanding bypass techniques against actual EDR security products, as well as hands-on materials on EDR neutralization.

LESSON2_EDR_vs_BYOVD.md compares automatic recovery times following process termination for major EDR products.

It appears to measure the window of opportunity for follow-on attacks by analyzing periods during which protection is active and inactive.

---

Lesson 3: Vulnerable Driver Hunting

Identified materials include:

• bd_test_k7old.bat
• bd_test_tfsysmon.bat
• bd_test_safetica.bat
• Driver_Hunting.md

Files for conducting repeated tests against multiple drivers using a previously known EDR Killer were identified.

Driver_Hunting.md describes the testing procedure for screening drivers usable for EDR neutralization.

The method involves:

1. Registering each driver as a Windows kernel service
2. Verifying its operational status and file existence
3. Removing the service after the test is complete
4. Determining whether the driver can operate in a real-world environment based on driver loading results

---

Lesson 4: Kernel-Level Research

Identified materials include:

• 0day_Driver_Research.md

Code for analyzing internal driver behavior or researching new kernel bypass techniques was identified.

0day_Driver_Research.md indicates that The Gentlemen was conducting its own research into 0-day drivers.

The document describes a previously undisclosed driver vulnerability that had not yet been assigned a CVE and documents subsequent steps taken to verify the vulnerability.

---

5. Exfiltrated Data

Global Technology Company (Jira)

Overview

In addition to the TukTuk framework and related attack materials, the analyzed server contained data assessed to have been exfiltrated from the Jira environment of a global technology company that provides a range of test, measurement, and network solutions used in the development and validation of key products across the semiconductor, telecommunications, electronics, and defense industries.

A total of 224 Jira tickets and eight Jira attachments were identified in the server's jira-loot folder. An attacker-created document organized the collected Jira materials into categories including internal technical support records, credentials, infrastructure-related information, customer communications, vulnerability-related materials, and technical attachments.

The 224 Jira tickets were organized into 19 categories, including credentials, vulnerabilities, defense-related information, and infrastructure.

Some attachments contained penetration testing reports, confidential PoC code, and internal technical documents associated with external organizations.

Indications were also found that PowerShell scripts were used to collect Jira system information and search Jira tickets for shared credentials and infrastructure-related data, including information associated with cloud infrastructure, VPN environments, source code management, and other enterprise systems.

The findings indicate that the exposed Jira environment contained not only the organization's internal information, but also technical data shared by customers and partners through support and business activities.

U.S. Defense & Defense-Industry Data

Among the exfiltrated Jira data, technical and operational information associated with U.S. defense organizations, defense contractors, and aerospace and defense companies was identified.

The exposed materials included:

• System and software configurations
• Equipment and system identifiers
• Host and network information
• Authentication and access issues
• Operational logs
• Software license management
• Asset and order management information
• Technical support and troubleshooting records
• Technical requirements
• Access-restricted attachments
• Confidential Proof-of-Concept materials

Records associated with U.S. defense organizations included authentication issues, system identifiers, host information, software versions, and technical support logs.

Other records covered software license issuance and equipment account management.

Materials associated with defense contractors and aerospace organizations included equipment configurations, system logs, asset records, and technical cooperation discussions. Confidential PoC documents and access-restricted attachments were also identified.

Global Healthcare Company (IaC)

The analyzed server also contained credential and infrastructure-related information associated with a global healthcare company's Infrastructure-as-Code (IaC) Platform.

The identified information was associated with multiple enterprise environments, including:

• AWS and cloud storage
• Production-related databases
• Azure AD
• Bitbucket
• Infrastructure configuration management
• Development and production environments

Administrator-level AWS Access Key information was identified along with information associated with cloud storage resources and databases.

Additional materials contained authentication and development environment credentials, infrastructure configuration information, cross-account cloud data, VPC endpoint information, and certificate-related information.

An environment configuration file contained 12 pieces of entitlement information, and a separate summary documented the access scope associated with the identified administrator-level cloud credentials.

The identified materials differed from previously disclosed leaked data associated with the same organization, suggesting the possibility of separate or additional intrusion activity.

---

Conclusion

Analysis of the server identified eb.sys, the TukTuk C2 framework, DLL sideloading configurations, and EDR neutralization research, showing an association with The Gentlemen. The complete TukTuk v2 project, with no known prior public disclosure, was found alongside step-by-step training materials.

The server also contained data assessed to have been exfiltrated from a global technology company, including information related to its U.S. defense and defense-industry customers, as well as separate credentials associated with a global healthcare company's IaC platform.

Relevant findings have been shared with the affected organizations and institutions.