A new ransomware threat named “The Gentlemen” has emerged in the cybersecurity landscape, demonstrating advanced attack capabilities and a well-structured operational model.

First appearing around July 2025, this group quickly established itself as a serious threat, publishing 48 victims on their dark web leak site between September and October 2025.

The ransomware operates as a Ransomware-as-a-Service platform, allowing affiliates to deploy attacks while the core operators maintain control over the infrastructure and negotiation processes.

The Gentlemen employs a dual-extortion strategy that combines file encryption with data theft. This approach not only locks victims out of their systems but also creates additional pressure by threatening to release stolen information on dark web leak sites unless ransom demands are met.

Before launching their own RaaS platform, the operators experimented with various affiliate models from other prominent ransomware groups, which helped them refine their methods and develop a more sophisticated operation.

Cybereason security researchers identified that the ransomware targets Windows, Linux, and ESXi platforms with specialized encryption tools.

The malware uses XChaCha20 and Curve25519 encryption algorithms to secure files, making recovery without the decryption key extremely difficult.

Recent updates introduced automatic self-restart and run-on-boot functionality, enhancing persistence on compromised systems.

Network Propagation and Lateral Movement Capabilities

The ransomware spreads across networks using Windows Management Instrumentation and PowerShell remoting techniques. When executed, the malware requires a password argument to begin its encryption routine.

It supports multiple operational modes, including system-level encryption under SYSTEM privileges and network share encryption through mapped drives and UNC paths.

The malware disables Windows Defender by executing PowerShell commands that turn off real-time protection and add directories and processes to exclusion lists.

It also enables network discovery and firewall rules, facilitating easier lateral movement across corporate networks.

The ransomware targets critical services and processes, including database engines like MSSQL and MySQL, backup utilities such as Veeam, and virtualization services like VMware.

To evade detection and complicate forensic investigations, the malware deletes Windows event logs, RDP connection logs, Windows Defender support files, and Prefetch data.

This anti-forensics approach significantly hinders incident response efforts and makes timeline reconstruction more challenging for security teams investigating the attack.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post ‘The Gentlemen’ Ransomware Group with Dual-Extortion Strategy Encrypts and Exfiltrates Data appeared first on Cyber Security News.

A China-aligned threat group known as PlushDaemon has been weaponizing a sophisticated attack method to infiltrate networks across multiple regions since 2018.

The group’s primary strategy involves intercepting legitimate software updates by deploying a specialized tool called EdgeStepper, which acts as a bridge between users’ computers and malicious servers.

This technique allows hackers to inject malware directly into what users believe are authentic update installations from trusted software vendors.

PlushDaemon’s campaign has targeted individuals and organizations in the United States, Taiwan, China, Hong Kong, New Zealand, and Cambodia.

The group employs multiple attack vectors, including exploitation of software vulnerabilities, weak network device credentials, and sophisticated supply-chain compromises.

During a 2023 investigation, researchers uncovered the group’s involvement in a major supply-chain attack affecting a South Korean VPN service, demonstrating their capability to operate at scale.

ESET security analysts identified and examined the EdgeStepper malware after discovering an ELF binary file on VirusTotal that contained infrastructure details linked to PlushDaemon operations.

The researchers found that the tool, internally codenamed dns_cheat_v2 by its developers, represents a critical component in the group’s attack infrastructure.

The analysis revealed how this network implant functions to intercept and redirect DNS queries, essentially hijacking the normal update process users expect from legitimate software.

The attack demonstrates a multi-stage infection process designed to evade traditional security defenses.

Once attackers compromise a network device such as a router through vulnerability exploitation or weak credentials, EdgeStepper begins its operation by intercepting DNS traffic.

When a user attempts to update software like Sogou Pinyin or similar Chinese applications, the malware redirects the connection to an attacker-controlled server.

This hijacking node then instructs the legitimate software to download a malicious DLL file instead of the genuine update.

DNS Interception and Traffic Redirection Mechanism

The technical foundation of EdgeStepper’s effectiveness lies in its elegant yet dangerous approach to network manipulation.

Written in Go programming language using the GoFrame framework and compiled for MIPS32 processors, the malware begins operation by reading an encrypted configuration file named bioset.conf.

The decryption process uses AES CBC encryption with a default key and initialization vector derived from the string “I Love Go Frame,” which is part of the GoFrame library’s standard implementation.

Once decrypted, the configuration reveals two critical parameters: toPort specifies the listening port, while host identifies the domain name of the malicious DNS node.

EdgeStepper then initializes two core systems called Distributor and Ruler. The Distributor component resolves the IP address of the malicious DNS node and coordinates the traffic flow, while the Ruler system issues iptables commands to redirect all UDP traffic on port 53 to EdgeStepper’s designated port.

The malware accomplishes this redirection using the command: “iptables -t nat -I PREROUTING -p udp –dport 53 -j REDIRECT –to-port [value_from_toPort]”.

This command essentially forces all DNS requests from devices on the network to pass through EdgeStepper before reaching legitimate DNS servers, creating a complete man-in-the-middle position that allows perfect interception and modification of update instructions sent to software applications.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Chinese PlushDaemon Hackers use EdgeStepper Tool to Hijack Legitimate Updates and Redirect to Malicious Servers appeared first on Cyber Security News.

A new wave of cyberattacks has emerged using the Tuoni Command and Control (C2) framework, a sophisticated tool that allows threat actors to deploy malicious payloads directly into system memory.

This technique helps attackers avoid detection by traditional security solutions that rely on scanning files stored on disk.

The Tuoni framework has gained attention in the cybersecurity community for its modular design and ability to support multiple attack scenarios without leaving significant traces on compromised systems.

The attack typically begins with phishing emails or compromised websites that deliver the initial payload. Once executed, the malware establishes a connection to the attacker’s C2 server and waits for further instructions.

What makes Tuoni particularly dangerous is its use of in-memory execution, meaning the malicious code runs entirely within the computer’s RAM without writing files to the hard drive.

This approach significantly reduces the chances of detection by antivirus software and endpoint protection tools.

Morphisec security researchers identified the threat during routine monitoring of suspicious network activities. Their analysis revealed that attackers were using Tuoni to deliver secondary payloads including credential stealers, ransomware, and remote access trojans.

The framework supports various communication protocols and can blend its traffic with legitimate network activity, making it challenging for security teams to identify compromised machines.

Technical Analysis of Tuoni’s In-Memory Execution

The Tuoni framework employs several advanced techniques to maintain stealth while operating on infected systems. At its core, the malware uses process injection to insert its code into legitimate Windows processes such as svchost.exe or explorer.exe.

This is achieved through API calls like VirtualAllocEx and WriteProcessMemory, which allocate memory space within the target process and write the malicious payload into that space.

LPVOID addr = VirtualAllocEx(hProcess, NULL, payloadSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, addr, payload, payloadSize, NULL);
CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)addr, NULL, 0, NULL);

The framework also implements encryption for its network communications, using AES-256 to encode data transmitted between the infected host and the C2 server.

This prevents network monitoring tools from inspecting the content of commands and stolen data. Organizations should implement memory scanning capabilities and monitor for unusual process behaviors to detect Tuoni infections effectively.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Using Leverage Tuoni C2 Framework Tool to Stealthily Deliver In-Memory Payloads appeared first on Cyber Security News.