EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
EtherRAT, a Node.js-based backdoor linked to a North Korean APT group, was detected in a retail customer's environment. It allows arbitrary command execution, extensive system information gathering, and asset theft. The malware uses 'EtherHiding' to store C2 addresses in Ethereum smart contracts, making infrastructure resilient to takedowns. It communicates using CDN-like beaconing to blend with normal traffic. Initial access varied, including ClickFix and IT Support scams via Microsoft Teams. A SYS_INFO module performs comprehensive host fingerprinting for target selection. The malware checks for CIS languages and self-destructs if found. It collects detailed system information, including hardware, software, and network details.
Pulse ID: 69c5a04382b357bdc81343b4
Pulse Link: https://otx.alienvault.com/pulse/69c5a04382b357bdc81343b4
Pulse Author: AlienVault
Created: 2026-03-26 21:08:19
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #CDN #CyberSecurity #ELF #EtherHiding #InfoSec #Korea #Malware #Microsoft #MicrosoftTeams #Nodejs #NorthKorea #OTX #OpenThreatExchange #RAT #bot #AlienVault