Loading malware…
EtherRAT is a cross-platform remote access trojan written in Node.js that has been used in Windows-domain intrusions, social-engineering campaigns, and broader post-compromise operations. It provides attackers with remote control of infected systems, including command execution, file manipulation, data theft, and long-term access. The malware is notable for using Ethereum blockchain infrastructure to resolve active command-and-control information, querying a smart contract rather than relying solely on hardcoded network locations. This design gives operators a resilient mechanism for rotating infrastructure and complicates disruption and tracking.
Observed Windows deployments show EtherRAT delivered through malicious MSI installers that bootstrap a Node.js runtime when needed, decrypt the embedded JavaScript implant, and establish persistence through user autorun mechanisms. In enterprise intrusions, operators have distributed those installers laterally using administrative shares, WMI, SMB, and remotely created scheduled tasks after obtaining privileged access. EtherRAT has also appeared in campaigns that abuse Microsoft Teams, where attackers impersonate IT support staff, persuade victims to grant remote control, and then use legitimate remote administration tools before executing the malware installer. Reporting also describes phishing lures, including employee-survey themed documents, as part of the initial social-engineering chain.
The malware has been associated with activity tied to an affiliate of the Gentlemen ransomware operation, where it formed part of a larger toolkit that included credential access, Active Directory collection, lateral movement, defense impairment, and fallback remote-access channels. Separate reporting indicates EtherRAT has been used beyond a single cluster and has appeared in campaigns linked to multiple threat actors. It has been observed targeting Windows environments directly and is described as capable of running on Linux and macOS as well, reflecting its Node.js-based portability.
Operationally, EtherRAT polls its controllers using web traffic patterns intended to blend in, and it can execute attacker-supplied JavaScript returned by the server, enabling flexible post-exploitation. Its role in intrusions is consistent with a persistent remote-access implant used to maintain footholds, support hands-on-keyboard activity, and facilitate follow-on actions including data theft and ransomware deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Q2: What is the CVE identifier for the vulnerability exploited in this attack? ... CVE-2025–55182 ... it’s a payload that abuses a JavaScript weakness (prototype pollution + constructor escape) to escape normal restrictions, then executes the system command id on the server. | CallMeOnTheChain - EtherRAT ... Q4: What is the filename of the decrypted implant that serves as the main RAT?
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2
Threat actors are weaponizing something as ordinary as a Microsoft Teams call to slip past corporate defenses and plant EtherRAT, a stealthy cross-platform remote access trojan.
Cybercriminals are using fake IT support calls on Microsoft Teams to persuade employees to surrender control of their PCs before installing the EtherRAT remote access trojan... EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS...
Ultimately, Atos Researchers identified it to be an EtherRat malware, a recently emerging threat using Ethereum to store C2 URL addresses, preventing takedown of the infrastructure.
this payload, dubbed EtherRAT, represents something far more sophisticated. It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.
“this payload, dubbed EtherRAT… is a persistent access implant… EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution…”
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers used administrative shares, Windows Management Instrumentation, and remote task registration to reach internal hosts.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
Scripts copied payloads to remote machines, then created tasks with names such as WinSvcUpdate2 and WindowsUpdSvc to make the activity appear routine.
One task ran under the SYSTEM account and downloaded a PowerShell script from the staging server.
deploy2.cmd uses a batch for loop to iterate through local IP addresses, creating remote Scheduled Tasks named WinSvcUpdate2.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
Scripts copied payloads to remote machines, then created tasks with names such as WinSvcUpdate2 and WindowsUpdSvc to make the activity appear routine.
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
The script created a local administrator account, attempted to add it to Domain Admins
The intrusion enables RDP, disables RDP Network Level Authentication, modifies UAC-related policy values and creates the EtherRAT Run value.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
Scripts copied payloads to remote machines, then created tasks with names such as WinSvcUpdate2 and WindowsUpdSvc to make the activity appear routine.
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
The attacker's account was tied to a domain crafted to resemble a genuine helpdesk address, which helped the impersonation feel convincing
the target receives an unsolicited Teams voice call from an external account impersonating a “System Administrator.”
the attacker downloads and runs a malicious MSI installer that quietly fetches a legitimate Node.js runtime, then decrypts hidden payloads bundled inside it
Once the victim answers, the attacker persuades them to enable Teams' built-in screen sharing feature, granting remote control of the device.
The malware then disguises its web requests with random paths and common-looking file extensions while polling for instructions.
EtherRAT polls its resolved C2 over HTTP(S); staging, task retrieval, registry-hive upload and Sliver HTTPS C2 also use web protocols.
The script created a local administrator account, attempted to add it to Domain Admins, disabled security services, exported registry hives, and set up a tunnel for remote access.
The deployment scripts used certutil.exe, a legitimate Windows utility, to retrieve an MSI package, then invoked msiexec.exe to install it quietly.
187 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
87 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Node.js-based remote access trojan/backdoor deployed via malicious MSI installers and remote scheduled tasks for lateral movement in Windows domains. It establishes Run-key persistence, can download Node.js if absent, executes JavaScript received from its C2, steals access, and uses an Ethereum smart contract to resolve current C2 domains, complicating tracking.
Remote access trojan deployed across Windows networks, using Ethereum smart contracts for command-and-control. The intrusion description notes polling traffic with an X-Bot-Server HTTP header, MSI delivery via certutil.exe and msiexec.exe, persistence through a Run key launching Node.js via headless conhost.exe, scheduled tasks, ESET service tampering, and installation under %LOCALAPPDATA%\MicrosoftSltt.
Referenced as another malware example using blockchain-based infrastructure for resilient redirection of compromised machines.
A remote access trojan referenced as an example of malware using blockchain-based infrastructure for resilient command-and-control or redirection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.