EtherRAT Campaign Linked to Shared Infrastructure Hosting Phishing Kits and Malware

Researchers uncovered a malicious infrastructure distributing EtherRAT, a Node.js remote access trojan delivered through exposed open directories alongside phishing pages, malicious documents, remote desktop software, and other malware. EtherRAT can execute arbitrary JavaScript received from its command-and-control servers and uses the Ethereum blockchain to retrieve active C2 information, a design that helps the operators maintain access even if parts of the infrastructure are taken down.

Analysis of the MSI and PowerShell delivery chains showed the malware installing or reusing Node.js, decrypting staged payloads, establishing persistence, and launching the final RAT via conhost.exe. Investigators also observed post-compromise reconnaissance activity and found misconfigured directories exposing phishing kit components, themed landing pages, and URL cloaker source code, indicating the same ecosystem was supporting both credential phishing and malware delivery, potentially for multiple actors or campaigns.