Loading malware…
EtherRAT is a cross-platform remote access trojan and backdoor implemented in Node.js and observed on Windows, Linux, and macOS. It provides full remote control of compromised systems, including remote command execution, file manipulation, arbitrary JavaScript execution delivered by its operators, data theft, and persistence. Multiple analyses also show reconnaissance behavior and, in some campaigns, theft of credentials, browser data, cryptocurrency-wallet material, SSH keys, cloud secrets, and other sensitive information through follow-on scripts or modules.
A defining characteristic of EtherRAT is its use of Ethereum-based dead-drop resolution for command-and-control discovery. Rather than relying only on static infrastructure, samples query public Ethereum JSON-RPC endpoints and use smart-contract state reads to obtain the active C2 address. This EtherHiding-style design increases resilience against conventional domain takedowns and allows operators to rotate backend infrastructure while keeping implants functional.
Observed delivery chains vary by campaign. EtherRAT has been deployed through malicious MSI installers, PowerShell and JavaScript loaders, open-directory malware distribution sites, and React2Shell exploitation chains. A prominent social-engineering pattern uses phishing emails followed by Microsoft Teams voice calls in which attackers impersonate IT or helpdesk staff, persuade victims to grant remote control, and then install legitimate remote-access tools before executing a malicious installer that loads EtherRAT. It has also appeared in ClickFix-style intrusions where users are tricked into pasting commands into the Windows Run dialog, after which staged loaders deploy EtherRAT alongside other tooling.
On Windows, loaders associated with EtherRAT have been observed downloading or bundling a legitimate Node.js runtime, decrypting embedded payloads, launching the RAT through headless console execution, and establishing persistence through autorun mechanisms. In broader intrusions, EtherRAT has been used after initial compromise as a secondary access mechanism and has been propagated laterally across multiple hosts. On Linux, observed variants have used systemd services, XDG autostart entries, shell profile modifications, cron, and SSH key installation for persistence.
EtherRAT has been linked to several distinct operational contexts rather than a single exclusive actor. It has been reported in campaigns exploiting React2Shell, in Microsoft Teams impersonation intrusions, and in post-compromise activity alongside other malware such as Potemkin and RMMProject. Reporting has also associated some EtherRAT-related activity with DPRK-linked or state-sponsored tradecraft, while other cases indicate adoption by broader financially motivated or criminal operators. This suggests EtherRAT is used across multiple campaigns and actor sets rather than being confined to one threat group.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Q2: What is the CVE identifier for the vulnerability exploited in this attack? ... CVE-2025–55182 ... it’s a payload that abuses a JavaScript weakness (prototype pollution + constructor escape) to escape normal restrictions, then executes the system command id on the server. | CallMeOnTheChain - EtherRAT ... Q4: What is the filename of the decrypted implant that serves as the main RAT?
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cybercriminals are using fake IT support calls on Microsoft Teams to persuade employees to surrender control of their PCs before installing the EtherRAT remote access trojan... EtherRAT is a Node.js RAT that runs across Windows, Linux, and macOS...
Threat actors are now weaponizing something as ordinary as a Microsoft Teams call to slip past corporate defenses and plant a stealthy new remote access trojan called EtherRAT.
A multi-stage attack chain distributing ransomware following a Malware infection with EtherRAT and TukTuk malware was identified, and some attack methods and infrastructure were exposed through internal leaks.
Ultimately, Atos Researchers identified it to be an EtherRat malware, a recently emerging threat using Ethereum to store C2 URL addresses, preventing takedown of the infrastructure.
this payload, dubbed EtherRAT, represents something far more sophisticated. It is a persistent access implant that combines techniques from at least three documented campaigns into a single, previously unreported attack chain.
“this payload, dubbed EtherRAT… is a persistent access implant… EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution…”
27 distinct techniques documented for this family, organized by ATT&CK tactic.
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
credentials that should never have left the network were suddenly used from an unauthorized external source... The trail led back to a single server: their public-facing web application.
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
What is the comment field in the attacker’s injected SSH public key?... ssh-rsa <public key> <comment> ... maromalix@ether_dev
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
What is the comment field in the attacker’s injected SSH public key?... ssh-rsa <public key> <comment> ... maromalix@ether_dev
It generates a fake-looking URL, which is used for Beaconing: https://<C2_DOMAIN>/api/<RANDOM>/<BOT_ID>/<RANDOM>.<EXT>?<PARAM>=<BOT_ID>
an attacker, posing as a "System Administrator" from an external Microsoft Teams account, initiates a voice call
The installer then decrypts hidden payloads bundled inside it, eventually launching the EtherRAT malware itself.
What C2 URL did the implant retrieve from the blockchain during execution?... https://63.176.62.199:443
Dead-Drop Resolution: Malware families, such as EtherRAT, function by querying public Remote Procedure Call (RPC) endpoints to read state data from specific smart contracts.
What is the filename of the script downloaded by the exploit payload to install the malware?... filter for the user-agent curl , and GET requests... s.sh
157 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan mentioned as a comparison to similar fake meeting/support-call campaigns.
Referenced as a stylistically similar Ethereum-resolver-based RAT used for comparison with the observed all-Python payload stack.
A remote access trojan implant for Linux that is installed via a downloaded shell script, stores components in a hidden directory, checks locale to avoid certain regions, resolves its C2 through Ethereum smart contracts, beacons to a retrieved HTTPS C2 URL, exfiltrates harvested credentials, and establishes persistence via a systemd user service and injected SSH key.
Named only in a related-articles reference; no substantive discussion in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.