The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2
EtherRAT
EtherRAT is a cross-platform, Node.js-based remote access trojan targeting Windows workstations, Linux servers, and macOS systems.
Profile source: Mallory opens in a new tabEtherRAT
Family profile
EtherRAT is a cross-platform, Node.js-based remote access trojan targeting Windows workstations, Linux servers, and macOS systems. It uses Ethereum smart contracts as a dead-drop resolver to obtain active command-and-control infrastructure, allowing operators to rotate backend servers without updating the implant. The malware can execute server-supplied JavaScript through its Node.js runtime, execute commands, manipulate files, steal and exfiltrate data, and maintain persistent access. Observed Windows deployments use malicious MSI installers that decrypt the implant, bootstrap Node.js when necessary, and establish user-level persistence. EtherRAT traffic can use randomized request paths and benign-looking extensions to blend into ordinary web activity. EtherRAT has been delivered through social-engineering operations including phishing lures, fake IT-support calls over Microsoft Teams, malicious copy-and-paste lures, and abuse of legitimate remote-access tools. It has also been observed in a Windows domain intrusion linked to an affiliate of the Gentlemen ransomware operation, where it was propagated through remote scheduled tasks alongside credential-theft, Active Directory collection, security-service tampering, and lateral-movement tooling. Linux-server targeting through exploitation of server-side vulnerabilities has also been reported.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Lateral Movement
- Persistence
- Post Exploitation
Reported operators
Threat actors
6 named in public reportingThreat actors are weaponizing something as ordinary as a Microsoft Teams call to slip past corporate defenses and plant EtherRAT, a stealthy cross-platform remote access trojan.
Cybercriminals are using fake IT support calls on Microsoft Teams to persuade employees to surrender control of their PCs before installing the EtherRAT remote access trojan... EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS...
Ultimately, Atos Researchers identified it to be an EtherRat malware, a recently emerging threat using Ethereum to store C2 URL addresses, preventing takedown of the infrastructure.
this payload, dubbed EtherRAT, represents something far more sophisticated. It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.
“this payload, dubbed EtherRAT… is a persistent access implant… EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution…”
Exploited software
Vulnerabilities linked to EtherRAT
1 CVEsMITRE ATT&CK
EtherRAT in ATT&CK
92 distinct techniquesTechniques
92 techniques T1059.007 JavaScript T1071.001 Web Protocols T1102 Web Service T1204 User Execution T1570 Lateral Tool Transfer T1071 Application Layer Protocol T1036 Masquerading T1105 Ingress Tool Transfer T1021.002 SMB/Windows Admin Shares T1218 System Binary Proxy Execution T1090 Proxy T1136 Create Account T1218.007 Msiexec T1562 Impair Defenses T1003 OS Credential Dumping T1568 Dynamic Resolution T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder T1098 Account Manipulation T1136.001 Local Account T1560 Archive Collected Data T1219 Remote Access Tools T1053 Scheduled Task/Job T1047 Windows Management Instrumentation T1059.001 PowerShell T1102.001 Dead Drop Resolver T1112 Modify Registry T1059.003 Windows Command Shell T1140 Deobfuscate/Decode Files or Information T1566.004 Spearphishing Voice T1566 Phishing T1078 Valid Accounts T1021 Remote Services T1059 Command and Scripting Interpreter T1564.001 Hidden Files and Directories T1497.001 System Checks T1098.004 SSH Authorized Keys T1190 Exploit Public-Facing Application T1543.002 Systemd Service T1649 Steal or Forge Authentication Certificates T1005 Data from Local System T1598.004 Spearphishing Voice T1566.001 Spearphishing Attachment T1656 Impersonation T1543 Create or Modify System Process T1598 Phishing for Information T1129 Shared Modules T1204.002 Malicious File T1090.002 External Proxy T1095 Non-Application Layer Protocol T1027 Obfuscated Files or Information T1497 Virtualization/Sandbox Evasion T1564.003 Hidden Window T1033 System Owner/User Discovery T1082 System Information Discovery T1027.002 Software Packing T1566.002 Spearphishing Link T1041 Exfiltration Over C2 Channel T1203 Exploitation for Client Execution T1546.004 Unix Shell Configuration Modification T1555 Credentials from Password Stores T1083 File and Directory Discovery T1046 Network Service Discovery T1059.004 Unix Shell T1053.003 Cron T1057 Process Discovery T1526 Cloud Service Discovery T1547 Boot or Logon Autostart Execution T1037 Boot or Logon Initialization Scripts T1556 Modify Authentication Process T1613 Container and Resource Discovery T1614.001 System Language Discovery T1482 Domain Trust Discovery T1564 Hide Artifacts T1657 Financial Theft T1566.003 Spearphishing via Service T1620 Reflective Code Loading T1608.006 SEO Poisoning T1055 Process Injection T1070 Indicator Removal T1195 Supply Chain Compromise T1547.013 XDG Autostart Entries T1567 Exfiltration Over Web Service T1210 Exploitation of Remote Services T1518 Software Discovery T1548.003 Sudo and Sudo Caching T1555.003 Credentials from Web Browsers T1552.001 Credentials In Files T1037.004 RC Scripts T1552.004 Private Keys T1027.011 Fileless Storage T1016 System Network Configuration Discovery
Reporting
Research mentioning EtherRAT
Jul 27
Cyber Security News
BlueNoroff Hijacks Trusted Telegram Accounts to Deliver ClickFix Malware Through Fake Zoom Calls
North Korean threat actors linked to BlueNoroff are running a targeted phishing campaign that impersonates Zoom and Microsoft Teams to compromise victims in the cryptocurrency sector. Researchers said the operation abuses hijacked Telegram accounts belonging to trusted real-world contacts, sending fake Calendly and meeting links that lead targets into staged video calls. The phishing kit captures webcam images, fingerprints browsers, checks for cryptocurrency-wallet indicators, and selectively advances only high-value victims to the next stage. Investigators also observed at least five versions of the kit between late May and mid-July, indicating active development and refinement. The campaign supports both Windows and macOS and uses a ClickFix-style lure to trick victims into executing malicious commands themselves. Reported post-click activity on Windows includes a PowerShell loader, a VBScript implant launched through wscript.exe, attempts to add Microsoft Defender exclusions, checks for Telegram sessions, and enumeration of browser extensions before possible follow-on payload delivery. Researchers also found the actors using AI-generated headshots composited onto authentic body movements from prior victims to make fake meetings appear convincing, turning routine video-call invitations into a highly selective malware-delivery pipeline.
Jul 27
Cryptika
BlueNoroff Hijacks Trusted Telegram Accounts to Deliver ClickFix Malware Through Fake Zoom Calls | Cryptika Cybersecurity
Jul 24
Trojan Killer News
BlueNoroff Zoom/Teams Kit Turns Calls Into ClickFix Malware | Trojan Killer
Jul 24
The Hacker News
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
Jul 21
Shroudcloud
ClickFix to EtherHiding - ShroudCloud
A ClickFix-style social engineering chain tricked a Windows user into running a PowerShell one-liner from the Run dialog, launching a multi-stage malware infection that deployed two Python-based payloads. The first stage downloaded a fake Intel Software Updater Inno Setup package, unpacked a bundled CPython 3.11 runtime, and launched a Python RAT that established persistence, profiled the host, and resolved follow-on command-and-control through the Ethereum blockchain using EtherHiding. A second PowerShell stage was then delivered over STDIN, downloading another Python runtime and payload into ProgramData, where mod.pyc decrypted its next stage with an inline RC4 routine before moving toward process injection into winver.exe and a UAC elevation attempt involving AppInfo and consent.exe. The activity aligns with a broader malware-delivery ecosystem previously linked to UNC5142, which used EtherHiding-backed infrastructure and rapidly changing hosting on Cloudflare Pages (pages.dev), Backblaze B2, and domains such as bluetroniq.vip and bytevista.cloud. Observed lures frequently impersonated verification and security workflows, including fake reCAPTCHA, human verification, DNS resolver, IP provider, and macOS browser update pages, with staging paths such as /support, /win, and /start indicating payload delivery and redirection infrastructure designed to support social engineering and malware distribution at scale.
