# EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver Blockchain-Resilient Node.js RAT

> Attackers impersonate IT helpdesk staff via 'Employee Survey' phishing emails followed by unsolicited external Microsoft Teams voice calls, socially engineering victims into installing legitimate remote access tools (HopToDesk, AnyDesk) that serve as a stepping stone to deploy the EtherRAT trojan via a malicious MSI installer. EtherRAT is a cross-platform Node.js RAT that resolves its active C2 server from an Ethereum smart contract (the EtherHiding technique) via consensus voting across nine public RPC endpoints, rather than relying on hardcoded or DNS-resolvable infrastructure.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-09-27T02:36:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1191
- **ID:** TL-2026-1191
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EtherRAT is a cross-platform (Windows/Linux/macOS) remote access trojan written entirely in Node.js, first identified by Palo Alto Networks Unit 42 and further profiled by Sysdig, Malwarebytes, and eSentire between April and July 2026. The malware's defining innovation is EtherHiding: rather than embedding a hardcoded C2 domain or IP, EtherRAT queries a public Ethereum smart contract through nine independent public RPC providers (e.g., eth.llamarpc.com, rpc.flashbots.net, ethereum-rpc.publicnode.com, eth.drpc.org, eth.merkle.io) in parallel and adopts the majority-consensus response as its live C2 address. Operators rotate infrastructure by issuing a new blockchain transaction to the contract at negligible cost, making conventional domain/IP takedown largely ineffective against the campaign's resilience.

In the July 2026 wave documented by Unit 42/The Register/BleepingComputer, initial access begins with a phishing email using an 'Employee Survey' lure containing a malicious PDF attachment. Shortly after the victim opens the document, an external Microsoft Teams account (observed as helpdesk@Progressive936.onmicrosoft[.]com) initiates an unsolicited voice call impersonating a 'System Administrator' from internal IT. Despite Teams displaying an 'External unfamiliar' label on the caller, victims are frequently convinced to grant remote control via Teams' built-in screen-sharing/control feature. The caller then walks the victim through installing legitimate remote-management software (HopToDesk and/or AnyDesk) as a persistence and access bridge, and subsequently directs the victim to download and execute a malicious MSI installer (observed as v7.msi, part of a versioned family v1-v10) staged at camorreado[.]click. The MSI acts purely as a loader: it silently fetches a legitimate, unmodified Node.js v20.10.0 runtime from nodejs.org, drops an AES-256-CBC-encrypted payload plus an obfuscated JavaScript dropper, decrypts the payload in memory, and launches EtherRAT under the legitimate Node.js interpreter, evading binary-signature-based detection.

A related, earlier distribution vector (documented by The Hacker News, active December 2025-April 2026) used 44 separate GitHub 'facade' repositories, each SEO-optimized to rank for and impersonate a specific high-privilege Windows administrative/developer tool (PsExec, AzCopy, Sysmon, LAPS, Kusto Explorer, WinDbg, etc.), deliberately targeting administrators and high-privilege accounts rather than standard users. A hidden link in each facade repo redirected to a secondary repository hosting the actual malicious MSI. This variant of the loader follows a four-stage architecture: Stage 0 batch-script dropper, Stage 1 in-memory decryption loader, Stage 2 registry Run-key persistence, Stage 3 full RAT with CDN-mimicking beacon traffic.

Once running, EtherRAT first executes a SYS_INFO reconnaissance module that performs comprehensive host fingerprinting (public IP via ipify.org, CPU model, username, hostname, OS platform/release/architecture, RAM, uptime, MAC address, GPU, installed antivirus products via WMI, Active Directory domain membership, and local-administrator status) before deciding whether to proceed. The module includes a CIS-language self-destruct check: if Russian, Belarusian, Kazakh, Kyrgyz, Tajik, Uzbek, Armenian, Azerbaijani, or Georgian language settings are detected on the host, EtherRAT deletes itself and exits, a common anti-analysis/anti-targeting pattern associated with DPRK- and CIS-region-aligned operators avoiding 'home turf' infections.

Command execution is implemented via the JavaScript AsyncFunction constructor, giving the C2-supplied code full access to Node.js primitives (require, process, Buffer, child_process) and effectively arbitrary remote code execution with the privileges of the logged-in user. EtherRAT establishes persistence redundantly across up to five independent mechanisms on Linux/macOS targets (systemd user services, XDG autostart entries, cron jobs, .bashrc injection, shell profile injection) and via HKCU registry Run keys on Windows. The malware supports self-update/self-reobfuscation: it can transmit its own source to a C2 /api/reobf/ endpoint, receive a freshly obfuscated replacement payload, and overwrite itself on disk, hindering static signature detection across generations. Beacon traffic to the resolved C2 mimics CDN static-asset requests using randomized paths of the form <C2>/api/<8-hex>/<uuid>/<8-hex>.<ext>?<param>=<build-id>, with extensions randomly chosen from png/jpg/gif/css/ico/webp and query parameter names from id/token/key/b/q/s.

Attribution is assessed with moderate confidence toward North Korea (DPRK)-linked activity. Sysdig identified overlap with documented Contagious Interview tooling (AES-256-CBC encrypted loaders, Node.js runtime abuse) and noted comparison to Google GTIG's UNC5342, previously linked to blockchain-based C2 (EtherHiding) and the BeaverTail malware family; Sysdig explicitly caveats that without direct code overlap the specific DPRK subgroup cannot be confirmed, leaving open the possibility of technique-sharing across multiple DPRK-aligned clusters. The Hacker News further reports the GitHub-facade distribution wave was linked to Lazarus Group, with additional code-commonality observations against Iranian group MuddyWater's Tsundere botnet, suggesting either technique convergence, shared tooling supply chains, or cross-attribution uncertainty that should be treated cautiously pending further corroboration. The campaign has also been reported (Malwarebytes) as co-hosted alongside broader phishing-kit infrastructure (Microsoft Teams, SharePoint, and email-service credential harvesting pages, plus URL-cloaking tooling) on misconfigured servers with exposed open directories, indicating a shared or brokered criminal infrastructure ecosystem rather than a fully bespoke DPRK build-out. No CVE applies; this is a social-engineering and legitimate-tool-abuse campaign, not a software vulnerability exploit, though the earlier React2Shell-linked variant (Sysdig) chains through a separate initial-access vector using base64-encoded shell downloader commands.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1587.001 Malware
- T1583.006 Web Services
- T1586.003 Cloud Accounts
- T1566.001 Spearphishing Attachment
- T1566.004 Spearphishing Voice
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1059.003 Windows Command Shell
- T1202 Indirect Command Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.013 XDG Autostart Entries
- T1543.002 Systemd Service
- T1053.003 Cron
- T1546.004 Unix Shell Configuration Modification
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation
- T1497.003 Time Based Checks
- T1070.004 File Deletion
- T1601.002 Downgrade System Image
- T1518.001 Security Software Discovery
- T1007 System Service Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1482 Domain Trust Discovery
- T1069.001 Local Groups
- T1005 Data from Local System
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1568 Dynamic Resolution
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1001.001 Junk Data
- T1552.001 Credentials In Files

## Sources

- [Fake IT bods on Microsoft Teams coax workers into installing malware](https://www.theregister.com/cyber-crime/2026/07/07/fake-it-bods-on-microsoft-teams-coax-workers-into-installing-malware/5267610)
- [Fake IT support calls on Microsoft Teams push EtherRAT malware](https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/)
- [EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks](https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks)
- [Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software](https://www.malwarebytes.com/blog/threat-intel/2026/06/inside-a-malicious-infrastructure-delivering-etherrat-phishing-pages-and-malicious-software)
- [EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons](https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons)
- [EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades](https://thehackernews.com/2026/04/etherrat-distribution-spoofing.html)
- [EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts](https://www.infosecurity-magazine.com/news/etherrat-bypass-security-ethereum/)
- [Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns](https://gbhackers.com/ethereum-based-etherrat/)
- [EtherRAT Signals A Strategic Shift From DPRK Hackers](https://securitybuzz.com/cybersecurity-news/etherrat-signals-a-strategic-shift-from-dprk-hackers/)
- [EtherRAT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/js.ether_rat)
- [Attackers use Microsoft Teams voice calls to deliver EtherRAT malware](https://www.scworld.com/brief/attackers-use-microsoft-teams-voice-calls-to-deliver-etherrat-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1191