# Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation Chain

> Threat actors impersonate IT/System Administrator staff via external Microsoft Teams accounts (e.g. helpdesk@Progressive936.onmicrosoft.com) and an 'Employee Survey' phishing lure to socially engineer victims into screen-sharing, then chain legitimate remote tools (HopToDesk, AnyDesk) into a malicious MSI installer (v7.msi, hosted at camorreado.click) that deploys a portable Node.js runtime and launches EtherRAT — a cross-platform RAT that resolves its C2 server from Ethereum smart contracts via the 'EtherHiding' technique. EtherRAT/EtherHiding tooling has TTP overlap with DPRK-linked 'Contagious Interview' activity (UNC5342) and has separately been chained by financially-motivated affiliates into TukTuk backdoors and Gentleman ransomware; a Linux variant of the same malware family has been deployed via exploitation of the React2Shell deserialization vulnerability (CVE-2025-55182, CVSS 10.0).

- **Published:** 2026-07-06T00:00:00Z
- **Last reviewed:** 2026-07-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1141
- **ID:** TL-2026-1141
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182

## Description

This threat documents an active social-engineering-to-malware campaign, first reported by Palo Alto Networks Unit 42 (GitHub report dated 2026-06-28, syndicated by BleepingComputer on 2026-07-06), in which attackers impersonate corporate IT/helpdesk staff to obtain hands-on-keyboard access to victim machines and deploy the EtherRAT remote access trojan. The intrusion begins with a phishing email carrying an 'Employee Survey' PDF lure, followed by a voice call or chat initiated from an external Microsoft Teams / Entra ID tenant account (helpdesk@Progressive936.onmicrosoft.com) impersonating a System Administrator. This mirrors a broader, well-documented 2026 trend of cross-tenant Teams helpdesk impersonation abused by multiple clusters (Microsoft's 'Help on the line' and cross-tenant helpdesk playbook advisories, Mandiant's UNC6692/SNOW malware campaign, and MuddyWater's false-flag ransomware Teams operation), all of which exploit Teams' default external-collaboration settings and use email bombing or urgency lures to justify unsolicited IT contact.

Once trust is established, the victim is walked through installing legitimate remote-access software (HopToDesk, then AnyDesk) via Teams screen-sharing, giving the attacker persistent remote control. The attacker then delivers a malicious MSI installer (observed as v1.msi through v9.msi in an open directory on camorreado.click) that acts as a loader: it silently drops a portable Node.js runtime, decrypts obfuscated JavaScript payloads, and launches EtherRAT.

EtherRAT is a cross-platform, Node.js-based backdoor whose defining feature is 'EtherHiding' — rather than hardcoding a C2 address that defenders can block or law enforcement can seize, the malware queries public Ethereum (and in related campaigns, BNB Smart Chain) RPC providers (e.g., 1rpc.io) to read the current C2 URL from an on-chain smart contract (observed contracts include 0xe26c57b7fa8de030238b0a71b3d063397ac127d3, 0xdf0b529043ef7a2bb9111bad26de624a326bacf9, and 0x5953f27F044779a3AFCd2BF56a4B712583Dd2E4e). Operators rotate infrastructure cheaply by issuing on-chain setString-style updates, and observed follow-on C2 destinations include TryCloudflare tunnels. Once connected, EtherRAT disguises beacon traffic as ordinary CDN requests (random hex paths, UUIDs, .ico/.png/.css extensions), persists via a 12-character randomized-hex Registry Run key executed headlessly through conhost.exe, self-modifies by having the C2 return freshly obfuscated source on each check-in, and provides remote command execution, file manipulation, OS/cloud fingerprinting, and theft of cryptocurrency wallets and cloud credentials. It also contains CIS-region language-based self-destruction logic consistent with DPRK-affiliated tooling.

Sysdig and multiple independent researchers (eSentire TRU, GBHackers, Infosecurity Magazine, cybersecuritynews) assess that EtherRAT and EtherHiding show significant TTP overlap with the DPRK-linked 'Contagious Interview' cluster tracked by Google as UNC5342 (aka CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, Void Dokkaebi), which has used EtherHiding since February 2025 to serve JADESNOW/INVISIBLEFERRET payloads from BNB Smart Chain and Ethereum contracts in fake job-interview lures. However, EtherRAT is also observed operating as a malware-as-a-service capability used by other, apparently financially-motivated actors: The DFIR Report documented an April 2026 intrusion in which a malicious MSI masquerading as Sysinternals 'RAMMap' deployed EtherRAT, which was chained into the 'TukTuk' backdoor (DLL-sideloaded via trojanized Greenshot/SyncTrayzor/DocFX/Cake binaries, using ClickHouse Cloud, Supabase, Ably, Dropbox, GitHub Issues, and an Arweave-blockchain-hosted config as C2/fallback channels) and ultimately domain-wide 'Gentleman' ransomware deployment via a malicious Group Policy Object staged through SYSVOL/NETLOGON scheduled tasks, following extensive AD/domain-trust reconnaissance, SoftPerfect Network Scanner discovery, NetExec- and Mimikatz-enabled lateral movement/credential theft, and Rclone-based mass exfiltration to Wasabi cloud storage.

Separately, Unit 42/BleepingComputer note that EtherRAT has previously been used in state-sponsored attacks exploiting the 'React2Shell' vulnerability (no CVE cited in the source article). Corroborating vendor research (Sysdig, Google Cloud, Microsoft, Cloudflare, AWS, Trend Micro) identifies this vulnerability as CVE-2025-55182, a maximum-severity (CVSS 10.0) unauthenticated remote code execution flaw in React Server Components' Flight deserialization logic (CWE-502, affecting react-server-dom-webpack 19.0.0, 19.1.0, 19.1.1, and 19.2.0), added to the CISA KEV catalog on 2025-12-05. Sysdig specifically reports a Linux-targeting EtherRAT variant deployed via React2Shell exploitation beginning December 2025, alongside separate China-nexus exploitation of the same CVE by Earth Lamia/Jackpot Panda deploying MINOCAT, SNOWLIGHT, HISONIC, COMPOOD, and XMRig — underscoring that React2Shell is a shared initial-access vector exploited by multiple unrelated threat clusters, of which the EtherRAT operators are one.

Malwarebytes independently mapped a broader malicious infrastructure cluster (June 2026) distributing EtherRAT MSI/PowerShell payloads, phishing pages, and remote-desktop software from open directories, consistent with the camorreado.click distribution model described here. Given full remote-access capability, credential and cryptocurrency theft, demonstrated ransomware follow-on, and confirmed active in-the-wild use across at least three independent DFIR/vendor reporting chains between December 2025 and July 2026, this threat is assessed HIGH severity/CRITICAL impact despite the absence of a single scored CVE for the malware itself.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1087 Account Discovery
- T1135 Network Share Discovery
- T1482 Domain Trust Discovery
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Fake IT support calls on Microsoft Teams push EtherRAT malware](https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/)
- [EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons](https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons)
- [EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts](https://www.infosecurity-magazine.com/news/etherrat-bypass-security-ethereum/)
- [Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum](https://cybersecuritynews.com/hackers-use-etherrat-and-etherhiding/)
- [Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns](https://gbhackers.com/ethereum-based-etherrat/)
- [EtherRAT Malware Hijacks Ethereum Blockchain for Covert C2 After React2Shell Exploit](https://securityonline.info/etherrat-malware-hijacks-ethereum-blockchain-for-covert-c2-after-react2shell-exploit/)
- [EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks](https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks)
- [EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades](https://thehackernews.com/2026/04/etherrat-distribution-spoofing.html)
- [Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware](https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [Help on the line: How a Microsoft Teams support call led to compromise](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)
- [Cross-tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)
- [UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware](https://thehackernews.com/2026/04/unc6692-impersonates-it-helpdesk-via.html)
- [Detecting Microsoft Teams Phishing: Hunting the Fake IT Helpdesk Threat](https://www.hunters.security/en/blog/microsoft-teams-phishing-fake-it-helpdesk)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1141