Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

An intrusion was observed in April 2026 where threat actors deployed EtherRAT malware through a malicious MSI installer disguised as a Sysinternals tool. The malware utilized Ethereum blockchain via EtherHiding for dynamic C2 configuration updates. Following reconnaissance activities, actors deployed TukTuk malware framework using DLL sideloading techniques with legitimate applications like Greenshot and SyncTrayzor. TukTuk established C2 channels through SaaS platforms including ClickHouse and Supabase, with backup channels via Ably, Dropbox, and GitHub Issues. The actors performed Kerberoasting, credential theft via Mimikatz and LSASS dumping, and deployed GoTo Resolve RMM tooling for lateral movement. Data exfiltration to Wasabi cloud storage was conducted using Rclone before deploying The Gentlemen ransomware domain-wide through a malicious GPO. The intrusion leveraged blockchain infrastructure, SaaS platforms, and decentralized services to evade traditional network defenses.

Pulse ID: 6a0200aec25a59a6b9d4edcf
Pulse Link: https://otx.alienvault.com/pulse/6a0200aec25a59a6b9d4edcf
Pulse Author: AlienVault
Created: 2026-05-11 16:15:42

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Cloud #CyberSecurity #Dropbox #EtherHiding #GitHub #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Rclone #SideLoading #UK #bot #AlienVault

Does iCloud Drive now lose almost all metadata?

https://fed.brid.gy/r/https://eclecticlight.co/2026/05/11/does-icloud-drive-now-lose-almost-all-metadata/

Explainer: File Provider and cloud services

https://fed.brid.gy/r/https://eclecticlight.co/2026/05/09/explainer-file-provider-and-cloud-services/

#Dropbox cut its backend monorepo from 87GB → 20GB.📉

In collaboration with #GitHub, they fixed a massive bottleneck by optimizing Git delta compression.

The impact:
• Reduced clone times
• Improved CI performance
• Boosted developer velocity

Learn more 👉 https://bit.ly/3R9pSfZ

#InfoQ #SoftwareArchitecture #Git #Monorepo #Optimization

Attack Activity Analysis Using SSH+TOR Tunnels for Covert Persistence

APT-C-13 (Sandworm), also known as FROZENBARENTS, is a state-sponsored advanced persistent threat group conducting global cyber espionage targeting government agencies, diplomatic departments, energy enterprises, and research organizations. Recently detected samples reveal the group's use of nested SSH and TOR tunnel architecture to establish covert communication channels. The attack begins with spear-phishing emails delivering malicious LNK files disguised as PDF documents. Upon execution, the payload deploys TOR hidden services mapping internal ports (SMB/445, RDP/3389) to onion domains, while SSH services with public key authentication provide encrypted remote access. The malware employs obfs4 protocol to obfuscate TOR traffic, evading deep packet inspection. Persistence is achieved through scheduled tasks masquerading as legitimate applications like Opera GX and Dropbox, establishing an anonymous shadow management infrastructure for sustained intelligence collection.

Pulse ID: 69f06b1eeeb1fca735cb0bb8
Pulse Link: https://otx.alienvault.com/pulse/69f06b1eeeb1fca735cb0bb8
Pulse Author: AlienVault
Created: 2026-04-28 08:09:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Dropbox #Email #Espionage #Government #InfoSec #LNK #Malware #OTX #Onion #OpenThreatExchange #Opera #PDF #Phishing #RDP #SMB #SSH #Sandworm #SpearPhishing #Worm #bot #AlienVault

Starting to properly look into an alternative to #Dropbox or #OneDrive. I'm currently paying AU$109/year ($9/month) for my home Office subscription which includes a terabyte of OD space. Dropbox is $184/year ($15/mo) for 2TB of space. I currently have about 100GB of data to house.

Looks like it costs about AU$80/month to put 100GB of data on a webhost in Australia.

Can anyone suggest somewhere priced in between that'd let me use NextCloud or similar? Boosts and suggestions welcome. #AskFedi