MalwarePublished 26 Mar 2026Updated 25 Apr 2026

EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons

Source AlienVault OTX General

Description

EtherRAT, a Node.js-based backdoor linked to a North Korean APT group, was detected in a retail customer's environment. It allows arbitrary command execution, extensive system information gathering, and asset theft. The malware uses 'EtherHiding' to store C2 addresses in Ethereum smart contracts, making infrastructure resilient to takedowns. It communicates using CDN-like beaconing to blend with normal traffic. Initial access varied, including ClickFix and IT Support scams via Microsoft Teams. A SYS_INFO module performs comprehensive host fingerprinting for target selection. The malware checks for CIS languages and self-destructs if found. It collects detailed system information, including hardware, software, and network details.

Impact

The impact of EtherRAT on organizations worldwide can be significant due to its capabilities for arbitrary command execution, extensive system reconnaissance, and asset theft. By leveraging Ethereum smart contracts for C2 communication, the malware's infrastructure is highly resilient, complicating incident response and takedown efforts. The CDN-like beaconing technique allows it to evade network detection, increasing the likelihood of prolonged undetected presence within networks. Organizations may suffer data breaches, intellectual property theft, and operational disruptions. The use of social engineering via Microsoft Teams and ClickFix scams highlights the risk to organizations relying on collaboration tools and remote support platforms. The malware's ability to self-destruct in certain language environments suggests a focused targeting approach, potentially leaving some regions less affected but increasing risk in others. The stealth and persistence of EtherRAT could lead to long-term espionage campaigns, financial losses, and reputational damage, especially for retail and other sectors targeted by this malware. The lack of known exploits in the wild indicates that detection and mitigation are still feasible but require proactive measures.

Defensive guidance

To mitigate the threat posed by EtherRAT, organizations should implement a multi-layered defense strategy tailored to its unique characteristics. First, enhance monitoring of network traffic for anomalies resembling CDN-like beaconing patterns, focusing on unusual or persistent connections to suspicious domains and IP addresses listed in threat intelligence feeds. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying Node.js-based backdoors and unusual process behaviors, including arbitrary command execution. Implement strict access controls and multi-factor authentication on collaboration platforms like Microsoft Teams to reduce the risk of social engineering attacks. Conduct targeted user awareness training focused on recognizing IT support scams and suspicious links or attachments delivered via collaboration tools. Regularly audit and restrict the execution of scripts and binaries, especially those related to Node.js environments. Employ threat hunting to identify signs of the SYS_INFO module's fingerprinting activities, such as unusual system information queries or process enumeration. Integrate blockchain monitoring tools to detect suspicious interactions with Ethereum smart contracts that may indicate EtherHiding activity. Finally, maintain updated threat intelligence feeds and share indicators of compromise (IOCs) with security teams to enable rapid detection and response. Incident response plans should include procedures for isolating infected systems and eradicating persistent backdoors leveraging decentralized C2 infrastructures.

Indicators of compromise

Domains 13

aurineuroth.com
euclidrent.com
hayesmed.com
jariosos.com
justtalken.com
mebeliotmasiv.com
o-parana.com
palshona.com
regancontrols.com
salinasrent.com

IP addresses 1

185.218.19.162

Hashes 8

03c4e54cc775ab819752dc5d420ab2fed03bd445c3ce398d021031100b334fb4
294c597c89023093e1e175949f5104f887b89cd8e1cf1d3192ee9032739f259e
2edf1ab615b489e228a89c617d24f66d1e780a6d5e30f6886608dfe79325acf8
47f74749cfcd55c8dacde2cc9b4c45282bec7a93ee19b7b81b452c99758d3370
5623f4f8942872b2b7cb6d2674c126a42bdf6ed5d1f37c1afc348529e4697d73
7dd1bf7a58774a081062f5c8f183d24f95c433805e0bf73280c0adba1c71390d
83b1f11c6a0bd267e415136440559131d2d4ace9a65dc221ea3b144fe0e7199b
b1ee812e7c786c8696f913595658e57706d97a66ca7b7634f421f5c552e7002b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Mar 2026, 22:00 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Domains 13

IP addresses 1

Hashes 8

Community reviews

Related threats