From TukTuk to Ransomware, Inovasys Detects Every Step

A recent campaign involving EtherRAT, TukTuk, and Gentleman Ransomware demonstrated how a seemingly legitimate Microsoft Sysinternals installer was weaponized to initiate a multi-stage attack that led to credential theft, lateral movement, data exfiltration, and domain-wide ransomware deployment.

At Inovasys, threats like these become more than intelligence reports. By analyzing every stage of the attack lifecycle, we transform real-world adversary techniques into stronger detection capabilities and proactive protection for our clients.

How the TukTuk Attack Worked

The attack began when a user executed a trojanized MSI installer disguised as a legitimate Microsoft Sysinternals utility.

Once launched, the installer deployed EtherRAT, which established persistence and leveraged blockchain technology alongside trusted cloud services to maintain resilient command-and-control communications while remaining difficult to detect.

As the intrusion progressed, the attackers expanded their access using legitimate administrative tools and remote management software before deploying Gentleman Ransomware across the environment.

The attack was designed to:

-Deliver malware through a trojanized trusted installer.

-Establish persistence using legitimate Windows mechanisms.

-Abuse blockchain and trusted SaaS platforms for command-and-control.

-Steal credentials and perform Active Directory reconnaissance

-Move laterally using legitimate remote management tools.

-Exfiltrate sensitive business data to cloud storage.

-Deploy ransomware across the enterprise through malicious Group Policy Objects (GPOs)

By combining trusted applications, cloud infrastructure, and stealth techniques, the attackers reduced the effectiveness of traditional detection methods while accelerating the path to ransomware.

How Inovasys Turns This Threat Into Protection

-Detection of trojanized installer execution

-Monitoring suspicious persistence mechanisms

-Identification of credential theft activity

-Detection of reconnaissance and lateral movement techniques

-Monitoring blockchain- and cloud-based command-and-control communications

-Detection of cloud-based data exfiltration activity

-Identification of ransomware deployment behaviours

Threat hunting was also performed using the identified indicators of compromise, with no related activity detected within the available client logs. The analysis confirmed that all fifteen detection opportunities identified throughout the attack lifecycle are already covered by the Inovasys detection library.

By converting these attacker techniques into detection use cases, we help organizations defend not only against this campaign, but also against future threats that rely on similar tactics.

Your Security, Strengthened With Every Threat

Every emerging attack strengthens the Inovasys defense stack.

Every campaign we analyze becomes another layer of protection for our clients.

Cybersecurity is continuous, intelligence-driven, and built to evolve. With Inovasys, your organization gains a cybersecurity partner that transforms global threats into proactive protection across your Digital Transformation Ecosystem.