Threat Briefing 50: Beyond the Organizational Perimeter: Analysis of The Gentlemen Ransomware and Space Supply Chain Risk

Overview

One of the core functions of Defensive Cyber Operations (DCO) is tracking, understanding and mitigating threats posed by financially motivated cybercriminals. These actors can be difficult to track, as much of their activity is opportunistic and indiscriminate. Occasionally, however, unique glimpses into high-impact campaigns emerge. Such a case surfaced when cybersecurity firm OASIS Security discovered an exposed adversary-controlled server associated with The Gentlemen ransomware group. Its analysis uncovered exfiltrated sensitive data alongside TukTuk C2, a previously undocumented, cross-platform command-and-control framework.

Crucially, the exfiltrated materials included 224 Jira tickets and eight attachments stolen from an unnamed global technology company providing specialized network and testing solutions. Because this technology vendor serves organizations across the defense and aerospace industries, the breach exposed sensitive secondary data, including U.S. defense system configurations, network and system identifiers, authentication issues and confidential proof-of-concept documents. Space ISAC reporting identified the incident as having downstream implications for multiple sectors, particularly U.S. aerospace and defense organizations.

Significance to the Space Sector

Among the exfiltrated Jira data, OASIS Security identified information associated with U.S. defense organizations, defense contractors and aerospace and defense companies. Exposed materials included system and software configurations, equipment identifiers, host and network information, authentication issues, operational logs, asset records, technical support information and confidential proof-of-concept documents. In the aerospace and defense-related material specifically, exposed information included authentication issues, system identifiers, host information, software versions, equipment configurations, system logs, asset records and confidential documents.

Modern spacecraft, launch systems, ground infrastructure and supporting enterprise networks depend on extensive networks of manufacturers, software developers, cloud providers, integrators, engineering firms and specialized technology vendors. The IT and software supply chain can create pathways through which sensitive information travels outside an organization’s direct security boundary. This incident underscores how upstream service providers and enterprise technology can serve as a significant entry point for cybercriminals. This can lead to exposure of proprietary information, brand and domain abuse, and potential compliancy gaps.

Supply Chain Exposure

In this instance, the attackers did not need to compromise each of their targets individually. Instead, information those organizations provided to a technology supplier during ordinary support interactions was concentrated inside the technology company’s Jira instance. Reporting indicates that PowerShell scripts were used to search tickets for credentials and infrastructure-related information, including references to cloud infrastructure, VPN environments, source-code management and other enterprise systems.

This turns a seemingly routine business platform into a valuable repository for an attacker. Support and troubleshooting tickets may contain host and network information, system and software configuration, technical requirements and other proprietary information. Individually, these fragments may appear relatively innocuous; however, collected at scale, they can provide a detailed map of another organization’s technology environment. Additionally, these details can be further weaponized via leak sites and illicit dark web marketplaces. For the space sector, where specialized suppliers may support multiple manufacturers, operators, integrators and government programs simultaneously, a single compromised organization can become a point of exposure for numerous downstream partners.

The Evolving Cybercrime-as-a-Service Landscape

The technical material uncovered by OASIS Security also offers insight into how quickly contemporary ransomware operations are evolving. Ransomware incidents are rising at a rate of approximately 25% year-over-year, according to data from Black Kite, and other security firms track around 140 to 150 active ransomware groups in 2026. Much of this expansion can be attributed to technical advancements, such as cross-platform capabilities, exploit kits and advanced C2 frameworks.

Reporting has recently uncovered TukTuk C2, which provides The Gentlemen with a cross-platform remote-control framework capable of collecting system information, transferring files, capturing screens, harvesting credentials and executing commands. Researchers additionally uncovered testing involving DLL sideloading and extensive material focused on neutralizing security products. This included experimentation with Bring Your Own Vulnerable Driver (BYOVD) techniques, in which attackers abuse legitimate but vulnerable drivers to interfere with defensive software.

The use of frameworks like TukTuk C2 underscores the increased sophistication that many of the top actors are operating with. The modern cybercrime ecosystem increasingly allows operators to combine specialized capabilities that enable initial access, credential theft, command-and-control infrastructure, defense evasion, data theft and extortion via as-a-service models. Such models can shorten the time between the emergence of a new technique and its adoption in real-world intrusions. Research into The Gentlemen also shows that ransomware operations should not be viewed simply as malware that encrypts data. Mature operators increasingly behave like adaptable intrusion actors, establishing persistent access, harvesting credentials and pivoting to other high value targets.

Conclusion

For the space sector, the greater takeaway from this campaign is how cybercriminals can weaponize information and trusted business relationships to impact organizations indirectly. This ties into the broader challenge of supply-chain resilience and external dependencies. In an agile and interconnected industry such as space, the same suppliers and enterprise platforms that make modern aerospace development possible can inadvertently aggregate sensitive information from numerous customers. In this case, compromising one technology company’s Jira environment exposed information belonging to organizations that were not necessarily directly breached themselves. Space ISAC consequently categorized the incident’s root cause as a third-party exposure, with associated risks including intellectual-property loss, compromised user accounts and misuse of data and resources.

Resilience increasingly depends on understanding where sensitive information travels, which suppliers retain it, how long it is retained, who can access it and what happens when one of those organizations is compromised. Federal guidance for space-system operators similarly emphasizes supply-chain security programs, verification that vendors employ appropriate cybersecurity measures and testing products and software before they are introduced into operational environments. In a constantly evolving threat landscape, organizations can further strengthen this visibility by both consuming and contributing actionable threat intelligence. Sharing information about adversary behavior, compromised infrastructure, vulnerabilities and third-party incidents can help transform an isolated organization’s experience into defensive knowledge for the broader community and ultimately strengthen collective defense.