Loading story…
Researchers reported a stealthy malware campaign targeting enterprise administrators, DevOps engineers, and security analysts by impersonating trusted administrative and developer utilities in malicious MSI installers. The operation used SEO poisoning to push victims toward spoofed tool listings and a dual-stage GitHub distribution chain in which benign-looking facade repositories redirected users to secondary repositories hosting the real payload, enabling operators to rotate malware quickly while preserving search credibility. At least 44 GitHub facade repositories spoofing IT tools were observed between December 2025 and early April 2026.
The payload, EtherRAT, is a multi-stage Node.js remote access trojan that downloads Node.js at runtime, establishes registry-based persistence, and executes through conhost.exe with a --headless argument to reduce visibility. Researchers said the malware uses layered AES-256-CBC encryption and retrieves its live command-and-control endpoint through public Ethereum RPC services and a hardcoded smart contract, effectively using the blockchain as a dead-drop resolver that complicates domain and IP takedowns. Reporting linked the campaign to prior EtherRAT and EtherHiding activity and said the tradecraft overlaps with malware previously associated with Lazarus Group, while also noting code similarities to Tsundere, a malware family tied in other research to MuddyWater (APT34).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
LevelBlue SpiderLabs reported that threat actors were distributing a trojanized Windows Tftpd64 utility from a spoofed GitHub repository to infect IT administrators and network professionals with a more sophisticated EtherRAT variant. The updated malware was described as combining host compromise with cryptocurrency theft, using bundled Node.js components, persistence via Windows Run keys, system reconnaissance, and interaction with Ethereum RPC endpoints and wallet addresses.
The Hacker News summarized Atos Threat Research Center's analysis, highlighting EtherRAT's Node.js-based multi-stage design, AES-256-CBC encryption, registry persistence, and blockchain-based dead-drop C2 resolution via Ethereum smart contracts. The report brought broader public attention to the campaign's technical details and resilience mechanisms.
In early April 2026, public threat research described the stealthy spoofed-tool campaign distributing EtherRAT and assessed it as suspected to be linked to a DPRK APT. The reporting also noted prior visibility from KISA and KrCERT/CC and referenced overlaps with previously attributed malware and infrastructure.
In April 2026, DFIR Report described an intrusion that began when a user ran a malicious MSI posing as Sysinternals RAMMap, installing an EtherRAT variant that resolved C2 via Ethereum infrastructure. The actor then deployed TukTuk, conducted credential theft and lateral movement, exfiltrated data with Rclone to Wasabi, and ultimately pushed The Gentlemen ransomware domain-wide via a malicious GPO.
By April 1, 2026, Atos had identified 44 GitHub facade repositories tied to the EtherRAT distribution effort. The finding showed sustained and organized abuse of GitHub to distribute the malware at scale.
The malware operation continued through March 2026, using SEO poisoning and a dual-stage GitHub distribution model to deliver EtherRAT while allowing operators to rotate payload repositories without losing search visibility. The campaign targeted high-privilege enterprise users with spoofed administrative tools.
Atos observed the campaign using GitHub facade repositories impersonating trusted administrative and developer utilities starting in December 2025. These repositories were used to lure enterprise administrators, DevOps engineers, and security analysts into downloading malicious MSI installers.
Atos reported that the EtherRAT distribution campaign had deployed at least 17 GitHub facade repositories starting in December 2024. The finding pushes the known start of the operation back a full year earlier than previously captured and shows the campaign had been active well before its 2026 public reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thedfirreport.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a malicious infrastructure distributing **EtherRAT**, a Node.js remote access trojan delivered through exposed open directories alongside phishing pages, malicious documents, remote desktop software, and other malware. EtherRAT can execute arbitrary JavaScript received from its command-and-control servers and uses the **Ethereum blockchain** to retrieve active C2 information, a design that helps the operators maintain access even if parts of the infrastructure are taken down. Analysis of the MSI and PowerShell delivery chains showed the malware installing or reusing Node.js, decrypting staged payloads, establishing persistence, and launching the final RAT via `conhost.exe`. Investigators also observed post-compromise reconnaissance activity and found misconfigured directories exposing phishing kit components, themed landing pages, and URL cloaker source code, indicating the same ecosystem was supporting both credential phishing and malware delivery, potentially for multiple actors or campaigns.
Jun 29, 2026
Threat actors are impersonating corporate IT support staff in **Microsoft Teams** voice calls to trick employees into granting remote access and installing the **EtherRAT** remote access trojan. The campaign begins with a phishing email themed as an **"Employee Survey"**, then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as **HopToDesk** or **AnyDesk**. Attackers then execute a malicious MSI installer, including samples such as `v7.msi`, to deploy a multi-stage loader that fetches a legitimate **Node.js** runtime, decrypts embedded payloads, and launches EtherRAT. Researchers said EtherRAT is a cross-platform Node.js RAT for **Windows, Linux, and macOS** that supports command execution, file manipulation, persistence, and data theft. The malware uses **Ethereum smart contracts** to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with `CtrlVirtualCursorWin_*` that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.
Jul 7, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026