Loading threat actor…
EtherRAT is a multi-stage malware campaign identified in late 2025 that exploited the React2Shell vulnerability, CVE-2025-55182, for unauthenticated remote code execution. The operation is notable for using Ethereum blockchain smart contracts as command-and-control infrastructure, an uncommon design choice intended to complicate disruption and tracking. Reported tradecraft has been characterized as highly sophisticated and exhibiting nation-state-style tactics, techniques, and procedures. High-confidence reporting supports EtherRAT as a malware campaign leveraging a public-facing application vulnerability for initial access and establishing remote control through a resilient, decentralized C2 mechanism. Publicly available information in this context does not firmly attribute the campaign to a specific threat actor, country, or long-term intrusion set, and confirmed victimology beyond exploitation of vulnerable React Server Components environments is not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.