The Gentlemen Deploy TukTuk C2 to Evade and Disable EDR

Summary

Threat intelligence analysis uncovered a server operated by the threat actor group The Gentlemen that contained the complete TukTuk C2 framework. The infrastructure also hosted advanced EDR neutralization research, including BYOVD (Bring Your Own Vulnerable Driver) techniques and 0-day driver research. Exfiltrated data from a global technology company’s Jira environment and a healthcare organization’s IaC platform was also discovered.

Investigation

Analysts identified the server through the AGATHA intelligence service and performed a forensic examination of its contents. The infrastructure was linked to The Gentlemen through matching hashes associated with the GentleKiller driver (eb.sys) and corresponding C2 dashboard identifiers. Investigators also categorized exfiltrated information connected to US defense and healthcare infrastructure.

Mitigation

Organizations should deploy robust EDR solutions and actively monitor for Bring Your Own Vulnerable Driver (BYOVD) activity. Jira environments and Infrastructure-as-Code (IaC) platforms should be hardened with strict credential management and access controls. Security teams should also monitor known DLL sideloading patterns involving legitimate applications such as Greenshot to reduce initial access opportunities.

Response

If TukTuk C2 artifacts or GentleKiller drivers are detected, affected hosts should be isolated immediately. Incident responders should conduct deep forensic analysis to identify lateral movement, credential theft, and additional persistence mechanisms. Access logs for AWS, Azure AD, and Bitbucket should also be reviewed to determine whether compromised IaC credentials were used.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deploy the TukTuk framework for C2 communication and EDR neutralization. To avoid immediate detection by signature-based tools, they attempt to use Greenshot.exe for DLL side-loading. By executing Greenshot.exe from a non-standard directory, they trigger the specific filename-based detection rule defined in the Sigma logic.

• Regression Test Script:

  # Create a temporary directory to simulate a staged deployment
  $tempPath = "$env:TEMPTukTuk_Sim"
  New-Item -Path $tempPath -ItemType Directory -Force
  Set-Location -Path $tempPath
  
  # Create a dummy executable named Greenshot.exe to trigger the detection
  # In a real scenario, this would be the actual malicious binary
  $dummyExe = "Greenshot.exe"
  New-Item -Path $dummyExe -ItemType File -Force
  
  # Since we cannot execute a zero-byte file, we will use a simple PowerShell command 
  # renamed to appear as the target process for the sake of telemetry generation
  # Note: To truly trigger 'Image' endswith in Windows logs, we simulate the process start.
  Write-Host "[!] Simulating execution of $dummyExe..."
  
  # We use a trick to launch a process that identifies as Greenshot.exe in the process tree
  # This is done via a scheduled task or by renaming a benign tool.
  Copy-Item "C:WindowsSystem32notepad.exe" -Destination "$tempPathGreenshot.exe"
  Start-Process "$tempPathGreenshot.exe"
  
  Start-Sleep -Seconds 5
  Write-Host "[+] Simulation complete. Check SIEM for Greenshot.exe process creation."

• Cleanup Commands:

  Stop-Process -Name "Greenshot" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPTukTuk_Sim" -Recurse -Force