Attributed metadata history
Up to 100 retained publisher events per page for 2b9e2015d668f15a0639be3ef0b81c40c517b1d6c4dd1b4eff6641f7c1b210e2. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_4a349ec95eeb880450
observed · 2026-10-12 09:41:03 UTC
available
Fingerprint: f7722c11597a8a71105e684b97a9970034dcfc15830c1a0fd7d73286b578f1c9
intelligence_src_4a349ec95eeb880450
observed · 2026-10-12 09:41:03 UTC
The EtherRAT malware family was first reported by Sysdig back in December 2025. At that time, the initial access vector was exploitation of CVE-2025-55182 (React2Shell) targeting Linux servers. In March 2026, a Windows variant campaign was reported by Atos, with their investigation showing evidence of activity going back to the previous December. In April, we […] The post Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware appeared first on The DFIR Report.
Fingerprint: 3e14aa51f809f371eddec18eb37e5e92f59b7c308966b355c6afb695e86a8379