Ransomware Hackers Use New TukTuk Malware to Steal Credentials and Disable Security Tools

Ransomware operators are using a previously undocumented remote-control framework called TukTuk to steal credentials, watch compromised machines, and weaken protections. The discovery links the tool to activity associated with the Gentlemen ransomware operation and shows how one intrusion can combine access theft, surveillance, and defense evasion. Its recovery gives defenders an unusual view of the infrastructure and research that can sit behind a ransomware operation. The framework was recovered from a server holding a malicious DLL sideloading set, EDR-disabling tools, and data believed taken from two large organizations. That mix suggests a prepared attack environment, able to move from an initial foothold to data theft...

Read the full article at the source.