EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
EtherRAT: Node.js Remote Access Trojan with Ethereum (TL-2026-0814), also tracked as EtherRAT, is a high-severity malware campaign, first published 2026-06-15. It has no confirmed attribution, affects Microsoft Windows, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 40 indicators of compromise.
Key facts for TL-2026-0814
- Threat ID
- TL-2026-0814
- Also known as
- EtherRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-15
- Last reviewed
- 2026-06-15
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- unspecified, general
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in EtherRAT: Node.js Remote Access Trojan with Ethereum
Malware and tooling: EtherRAT
Malwarebytes uncovered a sprawling malicious infrastructure distributing EtherRAT, a Node.js-based remote access trojan, alongside phishing pages and additional malware via open directories and compromised websites. EtherRAT resolves its command-and-control endpoints from a smart contract on the Ethereum blockchain (resistant to takedowns) and receives freshly obfuscated builds from C2 on each execution, defeating hash-based detection.
How EtherRAT: Node.js Remote Access Trojan with Ethereum works
EtherRAT is a remote access trojan written in Node.js that grants an operator complete control of an infected Windows host and the ability to execute arbitrary JavaScript returned by its command-and-control (C2) servers. Malwarebytes documented the malware as one payload of a broad malicious infrastructure that also serves phishing kits and other malware through open directories and compromised legitimate websites.
The infection chain begins on distribution websites that deliver either MSI installers (observed versions v1.msi through v10.msi) or PowerShell scripts (v*.ps1 variants). On execution, a BAT launcher (e.g. KmPuGimn.cmd) extracts components into a randomly named folder under %LOCALAPPDATA%. If Node.js is not already present, it is downloaded from official sources and extracted to a renamed subdirectory (observed as '28Q75h'); a copy of node.exe is staged for persistence as _MJlLlt5.exe. A JScript loader (cDQMlQAru0.xml) decrypts the encrypted EtherRAT payload (MRaQCipBIZeiZNx.log) using a custom XOR-based stream-decoding routine that employs byte rotations and accumulators. EtherRAT then establishes persistence by adding a registry run key that launches the staged Node copy via 'conhost.exe --headless' to suppress a visible window.
The defining trait of EtherRAT is its blockchain-based C2 resolution. Rather than hard-coding C2 addresses, the malware issues an eth_call JSON-RPC request to read the Ethereum smart contract at 0x88ea8d0bc4146f0a018e989df3fd089ac48f9a58, invoking function selector 0x7d434425 with argument 0xf6a772e163e64b07f658946f863b5d457d88f9f0. The contract returns the active C2 endpoint(s). Because the lookup is performed against public Ethereum RPC gateways (mainnet.gateway.tenderly.co, rpc.flashbots.net/fast, rpc.mevblocker.io, eth-mainnet.public.blastapi.io, ethereum-rpc.publicnode.com, eth.drpc.org, eth.merkle.io), the resolution channel blends into legitimate Web3 traffic and cannot be sinkholed or seized like ordinary DNS infrastructure; operators rotate C2 simply by updating contract state.
Once connected, EtherRAT performs environment reconnaissance — enumerating GPU, domain membership, and administrative status — and supports file and folder operations, registry modification, and arbitrary JavaScript execution. Collected data is written to a local log named svchost.log (a masquerade) prior to exfiltration to C2. Critically, EtherRAT supports self-reobfuscation: on each execution it can fetch a newly obfuscated build from C2, so its on-disk hash changes every run, neutralizing signature- and hash-based detection.
The surrounding infrastructure also hosts phishing pages (endpoints such as /zht/sharep-redirect.html, /bl/me.php, /t/teams, /teams/Windows/invite.php) that impersonate Microsoft Teams / SharePoint and harvest victim email addresses to advance the infection chain. Misconfigured open directories on the same servers exposed the phishing-kit source code, including a 'cl.zip' archive containing a 'URL Cloaker' page used to evade automated analysis. No CVE is associated with this campaign; severity is HIGH given full machine-compromise capability combined with takedown-resistant, detection-evading design.
MITRE ATT&CK techniques used in TL-2026-0814
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.007 System Binary Proxy Execution: Msiexec
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File; T1569.002 Service Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution
defense-impairment
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Affected products and versions in EtherRAT: Node.js Remote Access Trojan with Ethereum
- Microsoft — Windows
Vulnerable versions: all supported Windows desktop/server versions running the malicious installer - OpenJS Foundation — Node.js (abused runtime, not a vulnerability)
Vulnerable versions: downloaded on-demand by the loader
Remediation for EtherRAT: Node.js Remote Access Trojan with Ethereum
Immediate actions
- Block the six known C2 domains and six distribution domains at DNS/proxy/perimeter: cambioefectivo.com, vabelles.com, tranzed.org, kibrisarazi.com, aravisblog.com, publicspeakingtip.org, ivorilla.cloud, mx.nrlwz.com, dn.eyqwj.com, bi.mkrjcsw.com, dorqen.casa, kelvra.club
- Block the six known C2/distribution IPs at the firewall: 82.165.65.244, 185.221.216.121, 43.163.233.166, 40.160.238.30, 159.89.227.204, 57.128.31.168
- Hunt for node.exe / renamed node copies executing JavaScript from random %LOCALAPPDATA% subfolders and for 'conhost.exe --headless' run-key persistence
- Search endpoints for staged artifacts: KmPuGimn.cmd, cDQMlQAru0.xml, MRaQCipBIZeiZNx.log, _MJlLlt5.exe, svchost.log in user AppData\Local
Workarounds
- Egress-filter eth_call traffic to known Web3 RPC endpoints from workstations that have no legitimate blockchain use
- Disable execution of MSI/PowerShell installers from %LOCALAPPDATA% via AppLocker/WDAC policy
Longer-term hardening
- Deploy EDR with behavioral detection independent of file hashes, since EtherRAT self-reobfuscates on every execution
- Monitor and where possible restrict outbound connections to public Ethereum JSON-RPC gateways from non-developer endpoints
- Implement application allow-listing to block unsanctioned node.exe and msiexec-launched installers from user-writable directories
- User awareness training targeting fake Microsoft Teams/SharePoint invite and email-harvesting phishing lures
Timeline of EtherRAT: Node.js Remote Access Trojan with Ethereum
- Full multi-stage infection chain documented: MSI/PowerShell delivery, BAT launcher extraction to %LOCALAPPDATA%, on-demand Node.js install, JScript loader XOR-decrypting the encrypted payload, registry run-key persistence via 'conhost.exe --headless', then EtherRAT execution with C2 command handling and environment reconnaissance.
- Distribution documented serving a progressive series of payloads (v1 through v10) as MSI installers and PowerShell scripts from an '/install' folder; a v9.msi sample was analyzed in detail.
- Malwarebytes researchers discovered the infrastructure during threat-hunting activities after finding an exposed open directory hosting EtherRAT samples, phishing-kit source, and additional malware.
- Infrastructure assessed ACTIVE at time of reporting, distributing MSI (v1-v10.msi) and PowerShell (v*.ps1) loaders from compromised and attacker-controlled websites.
- Open directories on the campaign servers found exposing phishing-kit source code, including cl.zip containing a 'URL Cloaker' page used for analysis evasion.
- Per-execution self-reobfuscation confirmed: EtherRAT fetches newly obfuscated builds from C2, changing its file hash on each run to defeat hash-based detection.
- EtherRAT documented resolving C2 from Ethereum contract 0x88ea8d0bc4146f0a018e989df3fd089ac48f9a58 via eth_call against public Web3 RPC gateways.
- Malwarebytes releases IOCs: 6 IPs, 6 distribution domains, 6 C2 domains, the Ethereum C2 contract address, function selector, and queried RPC endpoints.
- Malwarebytes publishes research disclosing the malicious infrastructure delivering EtherRAT, phishing pages, and additional malware (author: Gabriele Orini).
Sources cited for EtherRAT: Node.js Remote Access Trojan with Ethereum
- Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software
- MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- MITRE ATT&CK T1102 — Web Service (dead-drop / C2 resolution)
- MITRE ATT&CK T1027 — Obfuscated Files or Information
- MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript
- MITRE ATT&CK T1566 — Phishing
Threats related to EtherRAT: Node.js Remote Access Trojan with Ethereum
- EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver Blockchain-Resilient Node.js RAT
- Fake Game Downloads Deliver Amatera Stealer via Ren'Py Loader, MSBuild Abuse, and EtherHiding C2
- PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM
- PamStealer: macOS Infostealer Distributed via Fake Maccy Sites Using PAM Password Validation
- Operation Endgame: Global Law Enforcement Takedown Disrupts SocGholish, Amadey, and StealC Malware-as-a-Service Networks
- PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer
Detection coverage for TL-2026-0814
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0814 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.