Loading malware…
EtherRAT is a cross-platform remote access trojan written in Node.js that provides attackers with full remote control of compromised systems. It has been observed on Windows, Linux, and macOS, and has also appeared in Linux server intrusions following exploitation of CVE-2025-55182 (React2Shell). A notable architectural feature is its use of Ethereum smart contracts and public JSON-RPC infrastructure to resolve active command-and-control endpoints, increasing resilience against conventional domain-based disruption. Some variants also maintain fallback conventional C2 mechanisms.
Observed delivery chains are multi-stage and vary by campaign. On Linux, EtherRAT has been deployed after React2Shell exploitation through shell scripts that install a Node.js runtime, decrypt staged JavaScript components, and establish persistence through mechanisms such as systemd services, XDG autostart entries, crontab, and shell profile modifications. On Windows, it has been delivered through malicious MSI installers, including trojanized software installers and loaders that fetch or bundle a legitimate Node.js runtime, decrypt embedded payloads, and launch the final implant, often via conhost for stealth. It has also been distributed through open directories hosting MSI, PowerShell, and JavaScript installers. In enterprise social-engineering campaigns, attackers have used phishing emails followed by Microsoft Teams voice calls impersonating IT support, persuading victims to grant remote control and install legitimate remote administration tools before executing a malicious MSI that loads EtherRAT. EtherRAT has also appeared in ClickFix-driven intrusions as a later-stage payload after initial compromise by other loaders.
Capabilities consistently attributed to EtherRAT include remote command execution, arbitrary JavaScript execution delivered by the C2, file manipulation, data theft, reconnaissance, and persistence. Linux-associated activity linked to EtherRAT has included delivery of follow-on scripts for host profiling, credential and wallet theft, SSH key installation, React2Shell scanning and exploitation, and web-server configuration abuse. Windows variants have been observed performing host reconnaissance such as locale, antivirus, GPU, domain, and session checks, and establishing persistence through Run-key execution of Node.js-based payloads. Some samples re-obfuscate themselves by sending their own source to the C2 and writing back a newly obfuscated version, complicating static detection and hash-based tracking.
EtherRAT has been associated with multiple intrusion sets and operational contexts rather than a single exclusive actor. Reporting has linked early activity to campaigns exploiting React2Shell, including activity assessed in some cases as DPRK-related or state-sponsored, while later use indicates broader adoption by criminal operators. It has been observed in hands-on-keyboard intrusions involving lateral movement, deployment across multiple hosts, coexistence with other malware families such as TukTuk and RMMProject, and use in attack chains that progressed to data theft, extortion, or ransomware deployment. Targeting has included corporate environments, public-facing Linux servers, and organizations reached through social-engineering lures abusing collaboration platforms such as Microsoft Teams.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Q2: What is the CVE identifier for the vulnerability exploited in this attack? ... CVE-2025–55182 ... it’s a payload that abuses a JavaScript weakness (prototype pollution + constructor escape) to escape normal restrictions, then executes the system command id on the server. | CallMeOnTheChain - EtherRAT ... Q4: What is the filename of the decrypted implant that serves as the main RAT?
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cybercriminals are using fake IT support calls on Microsoft Teams to persuade employees to surrender control of their PCs before installing the EtherRAT remote access trojan... EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS...
Threat actors are now weaponizing something as ordinary as a Microsoft Teams call to slip past corporate defenses and plant a stealthy new remote access trojan called EtherRAT.
A multi-stage attack chain distributing ransomware following a Malware infection with EtherRAT and TukTuk malware was identified, and some attack methods and infrastructure were exposed through internal leaks.
Ultimately, Atos Researchers identified it to be an EtherRat malware, a recently emerging threat using Ethereum to store C2 URL addresses, preventing takedown of the infrastructure.
this payload, dubbed EtherRAT, represents something far more sophisticated. It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.
“this payload, dubbed EtherRAT… is a persistent access implant… EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution…”
27 distinct techniques documented for this family, organized by ATT&CK tactic.
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
credentials that should never have left the network were suddenly used from an unauthorized external source... The trail led back to a single server: their public-facing web application.
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
What is the comment field in the attacker’s injected SSH public key?... ssh-rsa <public key> <comment> ... maromalix@ether_dev
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
What is the comment field in the attacker’s injected SSH public key?... ssh-rsa <public key> <comment> ... maromalix@ether_dev
It generates a fake-looking URL, which is used for Beaconing: https://<C2_DOMAIN>/api/<RANDOM>/<BOT_ID>/<RANDOM>.<EXT>?<PARAM>=<BOT_ID>
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
The installer then decrypts hidden payloads bundled inside it, eventually launching the EtherRAT malware itself.
What C2 URL did the implant retrieve from the blockchain during execution?... https://63.176.62.199:443
Dead-Drop Resolution: Malware families, such as EtherRAT, function by querying public Remote Procedure Call (RPC) endpoints to read state data from specific smart contracts.
What is the filename of the script downloaded by the exploit payload to install the malware?... filter for the user-agent curl , and GET requests... s.sh
157 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
78 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan implant for Linux that is installed via a downloaded shell script, stores components in a hidden directory, checks locale to avoid certain regions, resolves its C2 through Ethereum smart contracts, beacons to a retrieved HTTPS C2 URL, exfiltrates harvested credentials, and establishes persistence via a systemd user service and injected SSH key.
Named only in a related-articles reference; no substantive discussion in the content.
Cross-platform remote access trojan used after social engineering via Microsoft Teams to gain initial access to corporate networks. It can execute commands, steal data, maintain persistence, and uses Ethereum smart contracts for command-and-control servers.
Cross-platform remote access trojan built entirely in Node.js. It is delivered via a malicious MSI installer after social engineering through Microsoft Teams, then enables command execution, file manipulation, data exfiltration, and persistence. It uses Ethereum smart contracts to retrieve its command-and-control server address, complicating takedown efforts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.