The Gentlemen Used EtherRAT With Ethereum Smart Contract C2 in Windows Intrusions

Researchers linked a The Gentlemen ransomware affiliate to a Windows domain intrusion in which operators deployed EtherRAT, a Node.js-based implant that retrieves command-and-control infrastructure from an Ethereum smart contract and can execute arbitrary JavaScript returned by its server. The activity was reconstructed from an exposed open directory on 193.233.202[.]17, which captured tooling for persistence, credential theft, lateral movement, and remote access. Investigators said the intrusion used a broad post-exploitation stack including Sliver, custom Go reverse shells, Chisel, Ligolo-ng, Mimikatz, and Potato privilege-escalation tools, indicating preparation for domain-wide ransomware operations.

The operators reportedly used LOLBAS techniques to spread the malware across Windows systems, including certutil.exe to fetch an MSI package and msiexec.exe to install it silently through remote scheduled tasks. Persistence included scheduled tasks and a Run key named WindowsHost, while defenders were also given indicators such as ESET service tampering, an unusual X-Bot-Server HTTP header in EtherRAT polling traffic, and specific filesystem artifacts. Infrastructure analysis connected the staging server to additional controllers at 146.103.127[.]44 and 77.110.126[.]46, plus a related EtherRAT node at 77.110.122[.]58 using the same Ethereum contract, strengthening attribution to The Gentlemen and providing detection opportunities for defenders.