EtherRAT is a remote access trojan deployed by The Gentlemen affiliate that leverages an Ethereum smart contract for its command and control infrastructure. The malware targets Windows environments and uses various persistence mechanisms including scheduled tasks named WinSvcUpdate2, WindowsUpdSvc31, WindowsUpdateSvc, and SysUpdate. It employs LOLBAS techniques such as using certutil.exe to fetch MSI installers and msiexec.exe for silent installation. The malware also manipulates Windows services via sc.exe and installs itself under %LOCALAPPDATA%\MicrosoftSltt with logs stored in %APPDATA%\svchost.log. The C2 communication is identifiable by an X-Bot-Server HTTP header in the polling traffic. The use of blockchain-based C2 is notable for its resilience and stealth. The detailed analysis and IOCs are documented in the referenced hunt.io blog post.

The deployment of EtherRAT enables attackers to maintain persistent remote access on compromised Windows systems. The use of Ethereum smart contract-based C2 infrastructure complicates detection and takedown efforts. The malware's use of legitimate Windows tools and scheduled tasks aids in evasion and persistence. This can lead to unauthorized data access, lateral movement, and potential further compromise within affected networks.

No official patch or remediation is indicated in the available information. Defenders should refer to the detailed indicators of compromise and MITRE ATT&CK mappings provided in the linked vendor blog for detection and response. Monitoring for the specified scheduled task names, unusual use of certutil.exe and msiexec.exe, presence of the X-Bot-Server HTTP header in network traffic, and service tampering activities can aid in identifying infections. Incident response should focus on removing the malware and associated persistence mechanisms. Since this is a malware campaign rather than a software vulnerability, patching is not applicable.