TukTuk Malware Dead-Drop C2 via Arweave Gateway (arweave.net / g8way.io)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

Detects network activity initiated by the TukTuk malware to communicate with Arweave public gateways (arweave.net and g8way.io), which are utilized as dead-drop resolvers for C2 infrastructure resolution.