Executive Summary
Researchers have uncovered a broad malicious infrastructure distributing EtherRAT, a remote access trojan (RAT) developed in Node.js. This malware is notable for its use of the Ethereum blockchain to retrieve Command and Control (C2) server addresses via smart contract calls, making the infrastructure highly resilient to traditional takedown efforts. The campaign leverages phishing documents, malicious MSI installers, and PowerShell scripts to compromise victims, primarily focusing on credential theft and arbitrary code execution.
The technical analysis reveals a sophisticated multi-stage infection chain involving obfuscated batch files, JScript loaders, and the automated installation of Node.js environments if not already present on the target system. The infrastructure appears to be part of a 'Bulletproof' service potentially shared by multiple threat actors, hosting various phishing kits, URL cloakers, and remote desktop software. The widespread use of open directories and misconfigured domains facilitated the discovery of the campaign's underlying tools and source code.
This threat poses a significant risk due to its evasive delivery methods and decentralized C2 retrieval mechanism. Organizations should monitor for unauthorized Node.js execution and unusual blockchain-related JSON-RPC traffic on their networks to identify potential EtherRAT infections.