# EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious Interview

> EtherRAT is a multi-platform Node.js backdoor linked to North Korean APT operations (Contagious Interview / Jade Sleet). It uses Ethereum smart contracts to store and rotate C2 addresses (EtherHiding technique), making infrastructure takedown nearly impossible. Delivered via ClickFix social engineering on Windows and React2Shell (CVE-2025-55182) exploitation on Linux, EtherRAT features comprehensive host fingerprinting (SYS_INFO module), CIS-country geofencing, CDN-like beacon URLs for network evasion, and AES-256-CBC encrypted payloads. Active exploitation confirmed against retail, finance, and software sectors.

- **Published:** 2026-03-27T12:00:00Z
- **Last reviewed:** 2026-03-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0293
- **ID:** TL-2026-0293
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** DPRK APT (North Korea)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182

## Description

EtherRAT is a sophisticated Node.js-based remote access trojan (RAT) that represents a significant evolution in North Korean cyber operations, combining blockchain-based command and control infrastructure with multi-platform targeting capabilities.

## Architecture & Capabilities

EtherRAT operates as a modular Node.js implant with the following core capabilities: arbitrary command execution via AsyncFunction constructor providing full Node.js context (require, process, Buffer), comprehensive system fingerprinting through the SYS_INFO module, cryptocurrency wallet and cloud credential theft, self-reobfuscation by POSTing its own source code to C2 for server-side transformation, and an interactive JavaScript shell with complete module access.

The SYS_INFO module performs extensive host profiling including: public IP retrieval via ipify.org APIs, CPU model/username/hostname/OS platform/release/architecture enumeration, RAM metrics and uptime, MAC address extraction via os.networkInterfaces(), GPU identification (PowerShell WMI on Windows, lspci/glxinfo on Linux), antivirus detection via WMI queries or process enumeration, domain membership and administrative privilege checks, and Machine Hardware ID retrieval from registry or system files.

## EtherHiding — Blockchain C2 Infrastructure

EtherRAT's most notable innovation is its use of Ethereum smart contracts for C2 address storage and rotation (EtherHiding technique). Two smart contracts have been identified: 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 (eSentire campaign, Windows) and 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 (Sysdig campaign, Linux). C2 addresses are stored via the setString function and can be rotated by conducting additional blockchain transactions at minimal cost.

The implant queries nine public Ethereum RPC endpoints concurrently (eth.llamarpc.com, mainnet.gateway.tenderly.co, rpc.flashbots.net/fast, rpc.mevblocker.io, eth-mainnet.public.blastapi.io, ethereum-rpc.publicnode.com, rpc.payload.de, eth.drpc.org, eth.merkle.io) and uses majority-vote consensus to determine the authoritative C2 address, preventing single-endpoint poisoning attacks. This architecture makes traditional takedown methods ineffective since C2 addresses reside on immutable, distributed blockchain infrastructure.

## CDN-Like Beacon URLs

Network communications use randomized CDN-like beacon URLs following the pattern: <C2_ADDRESS>/api/<8_HEX>/<UUID>/<8_HEX>.<EXT>?<PARAM>=<BUILD_ID>. File extensions are randomly selected from png, jpg, gif, css, ico, and webp, while query parameters rotate through id, token, key, b, q, s, and v. All communications use HTTPS with TLS 1.3, and the C2 polling interval is 500 milliseconds. Responses exceeding 10 characters are treated as JavaScript code and executed with full Node.js context.

## Delivery Chains

**Windows (ClickFix/IT Support Scam):** Initial access via ClickFix social engineering or Microsoft Teams IT support scams with QuickAssist for unauthorized remote access. Stage 1 uses the LOLBin chain pcalua.exe -> mshta.exe with caret obfuscation to retrieve an HTA script from compromised infrastructure (shepherdsestates.uk). The HTA downloads a Node.js runtime (v18.17.0) and encrypted payloads. Stage 2 decrypts the stager using AES-256-CBC via module._compile() for in-memory execution and establishes HKCU Run key persistence with a random 12-character hex value name. Stage 3 launches EtherRAT via conhost.exe --headless node.exe.

**Linux (React2Shell / CVE-2025-55182):** Exploits an unsafe deserialization vulnerability in React Server Components affecting React 19.x and Next.js 15.x/16.x with App Router. A single HTTP request triggers unauthenticated RCE. A Base64-encoded shell command executes a persistent download loop using curl/wget/python3 fallbacks to retrieve a shell script (s.sh) from 193.24.123.68:3001. The script creates a hidden directory structure in $HOME/.local/share/.05bf0e9b, downloads Node.js v20.10.0, writes encrypted payload and obfuscated dropper, then establishes five independent persistence mechanisms: systemd user service, XDG autostart entry (Hidden=true, NoDisplay=true), cron job, .bashrc modification, and .profile modification with nohup commands.

## Geofencing & Target Selection

The SYS_INFO module implements CIS-country geofencing, performing self-destruction if detecting Russian, Belarusian, Kazakh, Kyrgyz, Tajik, Uzbek, Armenian, Azerbaijani, or Georgian language settings. This exclusion pattern is consistent with DPRK operational security practices. Active campaigns have targeted retail, business services, software, and finance sectors globally.

## Encryption & Obfuscation

All payload stages use AES-256-CBC encryption with embedded Base64-encoded keys and IVs. JavaScript obfuscation is performed via Obfuscator.io with string array shuffling and dead code insertion. Command-line obfuscation uses caret character insertion. The self-reobfuscation capability allows operators to remotely transform the implant code, complicating signature-based detection.

## Attribution

Multiple overlaps with DPRK Contagious Interview campaign: AES-256-CBC encrypted loader pattern (matching BeaverTail), Node.js runtime deployment approach, JavaScript-based interactive shell design, CIS-country geofencing, and ClickFix/IT support social engineering delivery. The Sysdig campaign via React2Shell represents either a tactical pivot or tool-sharing between threat groups. Attribution confidence is HIGH based on cumulative TTP overlap, though direct code reuse between EtherRAT and BeaverTail/InvisibleFerret has not been confirmed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.003 Spearphishing via Service
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1202 Indirect Command Execution
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.013 XDG Autostart Entries
- T1546.004 Unix Shell Configuration Modification
- T1053.003 Cron
- T1543.002 Systemd Service
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1036.004 Masquerade Task or Service
- T1564.003 Hidden Window
- T1218.005 Mshta
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1087 Account Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1007 System Service Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1008 Fallback Channels
- T1105 Ingress Tool Transfer
- T1102.001 Dead Drop Resolver
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0293