EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver Blockchain-Resilient Node.js RAT
EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft (TL-2026-1191), also tracked as EtherRAT vishing campaign, is a high-severity malware campaign, first published 2026-07-10. It is attributed to Contagious Interview cluster (North Korea) with low confidence, affects Microsoft Microsoft Teams, maps to 41 MITRE ATT&CK techniques (T1001.001, T1005, T1007), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1191
- Threat ID
- TL-2026-1191
- Also known as
- EtherRAT vishing campaign, EtherHiding Teams campaign, React2Shell EtherRAT variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-10
- Last reviewed
- 2026-07-10
- Attribution
- Contagious Interview cluster
- Attribution confidence
- LOW
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- technology, finance, health, government administration, professionalservices
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
Malware and tooling: EtherRAT, AnyDesk, EtherHiding, HopToDesk
Attackers impersonate IT helpdesk staff via 'Employee Survey' phishing emails followed by unsolicited external Microsoft Teams voice calls, socially engineering victims into installing legitimate remote access tools (HopToDesk, AnyDesk) that serve as a stepping stone to deploy the EtherRAT trojan via a malicious MSI installer. EtherRAT is a cross-platform Node.js RAT that resolves its active C2 server from an Ethereum smart contract (the EtherHiding technique) via consensus voting across nine public RPC endpoints, rather than relying on hardcoded or DNS-resolvable infrastructure.
How EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft works
EtherRAT is a cross-platform (Windows/Linux/macOS) remote access trojan written entirely in Node.js, first identified by Palo Alto Networks Unit 42 and further profiled by Sysdig, Malwarebytes, and eSentire between April and July 2026. The malware's defining innovation is EtherHiding: rather than embedding a hardcoded C2 domain or IP, EtherRAT queries a public Ethereum smart contract through nine independent public RPC providers (e.g., eth.llamarpc.com, rpc.flashbots.net, ethereum-rpc.publicnode.com, eth.drpc.org, eth.merkle.io) in parallel and adopts the majority-consensus response as its live C2 address. Operators rotate infrastructure by issuing a new blockchain transaction to the contract at negligible cost, making conventional domain/IP takedown largely ineffective against the campaign's resilience.
In the July 2026 wave documented by Unit 42/The Register/BleepingComputer, initial access begins with a phishing email using an 'Employee Survey' lure containing a malicious PDF attachment. Shortly after the victim opens the document, an external Microsoft Teams account (observed as helpdesk@Progressive936.onmicrosoft[.]com) initiates an unsolicited voice call impersonating a 'System Administrator' from internal IT. Despite Teams displaying an 'External unfamiliar' label on the caller, victims are frequently convinced to grant remote control via Teams' built-in screen-sharing/control feature. The caller then walks the victim through installing legitimate remote-management software (HopToDesk and/or AnyDesk) as a persistence and access bridge, and subsequently directs the victim to download and execute a malicious MSI installer (observed as v7.msi, part of a versioned family v1-v10) staged at camorreado[.]click. The MSI acts purely as a loader: it silently fetches a legitimate, unmodified Node.js v20.10.0 runtime from nodejs.org, drops an AES-256-CBC-encrypted payload plus an obfuscated JavaScript dropper, decrypts the payload in memory, and launches EtherRAT under the legitimate Node.js interpreter, evading binary-signature-based detection.
A related, earlier distribution vector (documented by The Hacker News, active December 2025-April 2026) used 44 separate GitHub 'facade' repositories, each SEO-optimized to rank for and impersonate a specific high-privilege Windows administrative/developer tool (PsExec, AzCopy, Sysmon, LAPS, Kusto Explorer, WinDbg, etc.), deliberately targeting administrators and high-privilege accounts rather than standard users. A hidden link in each facade repo redirected to a secondary repository hosting the actual malicious MSI. This variant of the loader follows a four-stage architecture: Stage 0 batch-script dropper, Stage 1 in-memory decryption loader, Stage 2 registry Run-key persistence, Stage 3 full RAT with CDN-mimicking beacon traffic.
Once running, EtherRAT first executes a SYS_INFO reconnaissance module that performs comprehensive host fingerprinting (public IP via ipify.org, CPU model, username, hostname, OS platform/release/architecture, RAM, uptime, MAC address, GPU, installed antivirus products via WMI, Active Directory domain membership, and local-administrator status) before deciding whether to proceed. The module includes a CIS-language self-destruct check: if Russian, Belarusian, Kazakh, Kyrgyz, Tajik, Uzbek, Armenian, Azerbaijani, or Georgian language settings are detected on the host, EtherRAT deletes itself and exits, a common anti-analysis/anti-targeting pattern associated with DPRK- and CIS-region-aligned operators avoiding 'home turf' infections.
Command execution is implemented via the JavaScript AsyncFunction constructor, giving the C2-supplied code full access to Node.js primitives (require, process, Buffer, child_process) and effectively arbitrary remote code execution with the privileges of the logged-in user. EtherRAT establishes persistence redundantly across up to five independent mechanisms on Linux/macOS targets (systemd user services, XDG autostart entries, cron jobs, .bashrc injection, shell profile injection) and via HKCU registry Run keys on Windows. The malware supports self-update/self-reobfuscation: it can transmit its own source to a C2 /api/reobf/ endpoint, receive a freshly obfuscated replacement payload, and overwrite itself on disk, hindering static signature detection across generations. Beacon traffic to the resolved C2 mimics CDN static-asset requests using randomized paths of the form <C2>/api/<8-hex>/<uuid>/<8-hex>.<ext>?<param>=<build-id>, with extensions randomly chosen from png/jpg/gif/css/ico/webp and query parameter names from id/token/key/b/q/s.
Attribution is assessed with moderate confidence toward North Korea (DPRK)-linked activity. Sysdig identified overlap with documented Contagious Interview tooling (AES-256-CBC encrypted loaders, Node.js runtime abuse) and noted comparison to Google GTIG's UNC5342, previously linked to blockchain-based C2 (EtherHiding) and the BeaverTail malware family; Sysdig explicitly caveats that without direct code overlap the specific DPRK subgroup cannot be confirmed, leaving open the possibility of technique-sharing across multiple DPRK-aligned clusters. The Hacker News further reports the GitHub-facade distribution wave was linked to Lazarus Group, with additional code-commonality observations against Iranian group MuddyWater's Tsundere botnet, suggesting either technique convergence, shared tooling supply chains, or cross-attribution uncertainty that should be treated cautiously pending further corroboration. The campaign has also been reported (Malwarebytes) as co-hosted alongside broader phishing-kit infrastructure (Microsoft Teams, SharePoint, and email-service credential harvesting pages, plus URL-cloaking tooling) on misconfigured servers with exposed open directories, indicating a shared or brokered criminal infrastructure ecosystem rather than a fully bespoke DPRK build-out. No CVE applies; this is a social-engineering and legitimate-tool-abuse campaign, not a software vulnerability exploit, though the earlier React2Shell-linked variant (Sysdig) chains through a separate initial-access vector using base64-encoded shell downloader commands.
MITRE ATT&CK techniques used in TL-2026-1191
Command and Control
T1001.001 Junk Data; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1568 Dynamic Resolution; T1571 Non-Standard Port
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1007 System Service Discovery; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1069.001 Local Groups; T1082 System Information Discovery; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.003 Time Based Checks
Persistence
T1053.003 Cron; T1543.002 Systemd Service; T1546.004 Unix Shell Configuration Modification; T1547.001 Registry Run Keys / Startup Folder; T1547.013 XDG Autostart Entries
Execution
T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.007 JavaScript; T1204.002 Malicious File
Initial Access
T1199 Trusted Relationship; T1566.001 Spearphishing Attachment; T1566.004 Spearphishing Voice
stealth
T1202 Indirect Command Execution; T1684.001 Impersonation
Credential Access
T1552.001 Credentials In Files
Impact
T1565.001 Stored Data Manipulation
Resource Development
T1583.006 Web Services; T1586.003 Cloud Accounts; T1587.001 Malware
Reconnaissance
T1589 Gather Victim Identity Information
defense-impairment
Affected products and versions in EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
- Microsoft — Microsoft Teams
Vulnerable versions: all versions supporting external voice calls and screen-sharing
Fixed in: N/A - social engineering, mitigated by external-caller warnings and admin policy, not a patch - Node.js Foundation — Node.js runtime
Vulnerable versions: v20.10.0 (abused as legitimate LOLBin-style runtime, not itself vulnerable)
Fixed in: N/A - AnyDesk Software GmbH — AnyDesk
Vulnerable versions: all versions (abused as legitimate RMM tool)
Fixed in: N/A - HopToDesk — HopToDesk
Vulnerable versions: all versions (abused as legitimate RMM tool)
Fixed in: N/A
Remediation for EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
Immediate actions
- Block outbound access to known EtherRAT C2 and staging domains at web/DNS proxy
- Alert on and restrict Node.js runtime downloads/execution originating from user-writable temp/appdata directories
- Enable and enforce Microsoft Teams external-caller warning labels ('External unfamiliar') and require verification before granting screen control to external callers
- Block or tightly restrict installation of unauthorized remote-access tools (HopToDesk, AnyDesk) via application allowlisting
- Hunt for MSI executions matching v1.msi-v10.msi naming pattern and for files beginning 'CtrlVirtualCursorWin_*' left by Teams remote-control sessions
Workarounds
- Disable or restrict Microsoft Teams calls/chat from users outside the organization's tenant for users without a legitimate external-support business need
- Require secondary out-of-band verification (ticketing system, phone callback to a known IT extension) before granting any remote-control session initiated via unsolicited Teams call
Longer-term hardening
- Deploy EDR with behavioral detection for AsyncFunction-based dynamic JS execution under node.exe/node processes
- Implement outbound network monitoring for parallel connections to multiple public Ethereum RPC endpoints from endpoint hosts (anomalous for non-developer workstations)
- Security-awareness training specifically covering Teams-based vishing/impersonation and 'IT helpdesk' social engineering
- Restrict or monitor use of legitimate remote-management tools (RMM) via a formal allowlist and centralized deployment-only policy
- Monitor GitHub for facade/typosquat repositories impersonating internal-use administrative tooling before employees discover them via search
Weaknesses (CWE) in EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
CWE-1021, CWE-494, CWE-829
Timeline of EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
- Threat actors begin deploying the first of 44 SEO-optimized GitHub facade repositories impersonating Windows administrative tools (PsExec, AzCopy, Sysmon, LAPS, Kusto Explorer, WinDbg) to distribute early EtherRAT MSI installers, per The Hacker News reporting.
- The Hacker News publishes analysis of the GitHub-facade distribution campaign, documenting 44 spoofed repositories active December 2025-April 2026 and linking the activity to Lazarus Group with code overlaps to MuddyWater's Tsundere botnet.
- eSentire publishes technical analysis of EtherRAT's SYS_INFO reconnaissance module, EtherHiding C2 resolution mechanism, and CDN-mimicking beacon traffic format.
- Sysdig publishes analysis linking EtherRAT to a React2Shell-associated attack chain and North Korea-linked Contagious Interview tooling, noting overlap with Google GTIG's UNC5342 blockchain C2 techniques and BeaverTail malware, with attribution caveated as unconfirmed at the code level.
- Malwarebytes documents a broader malicious infrastructure cluster serving EtherRAT alongside Microsoft Teams/SharePoint/email phishing pages and URL-cloaking tools via misconfigured servers with exposed open directories.
- Unit 42 observes EtherRAT MSI installer samples updated as recently as this date, indicating the malware family (versions v1 through v9/v10 documented) is under active, ongoing development.
- Coverage notes Microsoft has added/is adding Teams defenses relevant to this technique: external-caller identification warnings, brand-impersonation alerts, and automated third-party bot lobby placement for external meeting participants.
- Palo Alto Networks Unit 42 discloses the Microsoft Teams vishing campaign: phishing 'Employee Survey' emails followed by external Teams voice calls from helpdesk@Progressive936.onmicrosoft[.]com impersonating IT support, leading victims to install HopToDesk/AnyDesk and execute a malicious v7.msi installer staged at camorreado[.]click. Reported concurrently by The Register, BleepingComputer, and SC Media.
Sources cited for EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
- Fake IT bods on Microsoft Teams coax workers into installing malware
- Fake IT support calls on Microsoft Teams push EtherRAT malware
- EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks
- Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software
- EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
- EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades
- EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts
- Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns
- EtherRAT Signals A Strategic Shift From DPRK Hackers
- EtherRAT (Malware Family)
- Attackers use Microsoft Teams voice calls to deliver EtherRAT malware
Threats related to EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft
- EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious Interview
- Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation Chain
- EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
- Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution
- DOUBLECUP ClickFix Loader-as-a-Service Hides Malware in Browser Cache Images via Steganography
Detection coverage for TL-2026-1191
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1191 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.