Microsoft

An intrusion began with a malicious MSI masquerading as Sysinternals RAMMap, deploying an EtherRAT variant that used Ethereum blockchain for C2 configuration. The threat actor later deployed TukTuk malware, a new AI-generated framework using SaaS platforms for C2, and ultimately executed The Gentleman ransomware across the domain via GPO after disabling defenses and...