MalwarePublished 5 Aug 2026

The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

Source Reddit NetSec

Discussion

An exposed open directory at a staging server revealed an active intrusion by operators linked to The Gentlemen ransomware group. The operation involved establishing persistent access through privileged account creation, credential theft via LSASS dumping, and lateral movement across a Windows domain. Attackers deployed multiple implants including EtherRAT, which retrieves command-and-control domains from an Ethereum smart contract, alongside Sliver and custom Go reverse shells. Lateral movement was achieved through remote scheduled tasks distributing MSI payloads, while security products were disabled and reverse tunnels established for persistent access. The infrastructure and tactics align with previously documented The Gentlemen campaigns, including a ClickFix operation deploying EtherRAT.

r/netsec (opens in a new tab)u/Straight-Practice-990 points0 comments

Defensive-leaning breakdown of a The Gentlemen intrusion recovered from an exposed open directory. Detection surface worth noting:

X-Bot-Server HTTP header on EtherRAT polling traffic
Scheduled task names: WinSvcUpdate2, WindowsUpdSvc31, WindowsUpdateSvc, SysUpdate
LOLBAS chain: certutil.exe fetches the MSI, msiexec.exe installs silently
Run-key WindowsHost under HKCU launching Node.js through headless conhost.exe
ESET service tampering via sc.exe across eight named services
EtherRAT install path %LOCALAPPDATA%\MicrosoftSltt and log at %APPDATA%\svchost.log

Full detail, MITRE mapping and IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2 .

Links cited in the discussion

https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2

Impact

The deployment of EtherRAT enables attackers to maintain persistent remote access on compromised Windows systems. The use of Ethereum smart contract-based C2 infrastructure complicates detection and takedown efforts. The malware's use of legitimate Windows tools and scheduled tasks aids in evasion and persistence. This can lead to unauthorized data access, lateral movement, and potential further compromise within affected networks.

Defensive guidance

Defenders should refer to the detailed indicators of compromise and MITRE ATT&CK mappings provided in the linked vendor blog for detection and response. Monitoring for the specified scheduled task names, unusual use of certutil.exe and msiexec.exe, presence of the X-Bot-Server HTTP header in network traffic, and service tampering activities can aid in identifying infections. Incident response should focus on removing the malware and associated persistence mechanisms. Since this is a malware campaign rather than a software vulnerability, patching is not applicable.

Summary

EtherRAT is a remote access trojan deployed by The Gentlemen affiliate that leverages an Ethereum smart contract for its command and control infrastructure. The malware targets Windows environments and uses various persistence mechanisms including scheduled tasks named WinSvcUpdate2, WindowsUpdSvc31, WindowsUpdateSvc, and SysUpdate. It employs LOLBAS techniques such as using certutil.exe to fetch MSI installers and msiexec.exe for silent installation. The malware also manipulates Windows services via sc.exe and installs itself under %LOCALAPPDATA%\MicrosoftSltt with logs stored in %APPDATA%\svchost.log. The C2 communication is identifiable by an X-Bot-Server HTTP header in the polling traffic. The use of blockchain-based C2 is notable for its resilience and stealth. The detailed analysis and IOCs are documented in the referenced hunt.io blog post.

Indicators of compromise

Domains 5

resumeacceptable.com
publisherresolution.com
simultaneouslypower.com
wiselystarting.com
itemrange.com

URLs 1

http://193.233.202.17:9001

IP addresses 11

193.233.202.17
185.45.193.151
38.110.228.43
77.110.122.137
77.110.126.46
77.110.122.58
146.103.127.44
185.117.72.215
38.110.228.125
38.110.228.33

Hashes 15

4b690f3ce585df982a042917b82642c8
bd1eaea733425cd21a51a652c429951d
60285f6776cc3ff20872feeee7f2fd0b3b04410d
9dd99bc68e60132f32fc33617deb9583c8cebb51
73955566338adffb423c3b7608792963080da780e8b7b2c2cd6b6b0cef6f217f
7567994310a9576b1f98dc672ecfa038f1d65084315f59e3883f9b6f24000073
756c2096f54c5497110c9d854625c3ed592873e566d532077cd7adb4d10d4add
86881b8e9d197ac2f734792de48d5dfaebe7cafb6e35d49c5dd7fe6eb697230e
bd61c2880920bbfb86c12df439dd1ca0258a10e532433698fd029aef2a5b33f2
c7a80576fbd25057435652788591d13998da272edf627fc29d296684cefc50e5

References

Community reviews

Loading reviews…