EtherRAT has surfaced in a Windows domain intrusion tied to an affiliate of the Gentlemen ransomware operation. The campaign shows how a single foothold can become a network-wide problem when attackers gain privileged access.
The operators used remote scheduled tasks to push malicious installer packages to other systems.
Those installers deployed EtherRAT, a remote access tool built around Node.js that can receive instructions, steal access, and keep running after the initial compromise.
Recent reporting on EtherRAT blockchain hiding techniques shows why this design can make tracking its infrastructure harder.
Analysts at Hunt.io identified the activity after finding an exposed directory on a server used during the intrusion.
The collection contained scripts, task configurations, installers, tunnelling tools, and reverse shells, offering an unusually detailed view of an active operator toolkit.
Hunt.io said in a report shared with Cyber Security News (CSN) that the evidence points to an effort to preserve several routes back into a victim environment while collecting credentials and Active Directory data.
task_39.ps1 Execution chain (Source – Hunt.io)
That combination raises the risk of rapid disruption across connected systems, particularly because one compromised administrator account can turn into broad domain control.
Similar ransomware attacks targeting Windows domains have relied on the same advantage.
Remote Scheduled Tasks Spread EtherRAT
The attackers used administrative shares, Windows Management Instrumentation, and remote task registration to reach internal hosts.
Scripts copied payloads to remote machines, then created tasks with names such as WinSvcUpdate2 and WindowsUpdSvc to make the activity appear routine.
This is a practical reminder that Windows task scheduler abuse is not only a persistence trick, but also a delivery method for lateral movement.
One task ran under the SYSTEM account and downloaded a PowerShell script from the staging server.
The script created a local administrator account, attempted to add it to Domain Admins, disabled security services, exported registry hives, and set up a tunnel for remote access.
EtherRAT deployed via remote Scheduled Tasks (Source – Hunt.io)
It also staged reverse-shell tooling, giving the operator backup options if one access route failed.
The deployment scripts used certutil.exe, a legitimate Windows utility, to retrieve an MSI package, then invoked msiexec.exe to install it quietly.
A fallback path copied the installer through SMB. This blend of built-in tools and administrative access can look like ordinary system work unless teams review task-creation events, unusual remote share writes, and unexpected processes launched through task scheduler.
The recovered files linked the activity to the Gentlemen cluster. The attribution is an assessment, but the shared tooling, installer naming, and infrastructure provide strong context for defenders investigating related incidents.
Blockchain C2 Extends Access
After installation, EtherRAT decrypts a JavaScript backdoor and establishes a Run-key entry so it launches again when the user signs in.
If Node.js is unavailable, the installer downloads a runtime first. The malware then disguises its web requests with random paths and common-looking file extensions while polling for instructions.
Its most distinctive feature is where it finds its command server. Instead of keeping a single address inside the malware, EtherRAT queries an Ethereum smart contract for the current domain.
The operator can change that destination without replacing the implant, while investigators can examine the contract history to reconstruct earlier domains. Earlier coverage of EtherRAT malicious MSI installers documented the malware’s growing Windows focus.
ASN overlaps across The Gentlemen C2 infrastructure (Source – Hunt.io)
Any server response longer than ten characters can be treated as JavaScript and executed by the implant.
That gives the operator a flexible way to run commands, access files, start processes, contact the network, or pull in new payloads without a fixed feature set. The custom X-Bot-Server HTTP header is a useful detection clue for security teams.
Defenders should urgently review scheduled tasks created remotely, especially those running as SYSTEM or calling PowerShell, certutil, msiexec, or files outside normal application paths.
They should also investigate new privileged accounts, security-service changes, outbound traffic to public Ethereum RPC services, and connections to the infrastructure listed below.
Isolating affected hosts, resetting exposed credentials, and checking for Run-key persistence can help contain a suspected spread before it reaches more systems.
Indicators of Compromise (IoCs):-
TypeIndicatorDescriptionIP address193.233.202.17Primary staging, C2, Sliver, tunnelling, and registry-hive exfiltration serverIP address146.103.127.44Secondary controller embedded in Go reverse-shell binariesIP address77.110.126.46Secondary controller embedded in Go reverse-shell binariesIP address77.110.122.137Case-observed Gentlemen infrastructureIP address77.110.122.58Staging server associated with cons1.0.1.msiIP address38.110.228.43Historical resolution for wiselystarting.comIP address38.110.228.125Historical resolution for itemrange.comIP address38.110.228.33Open directory containing disclosed Gentlemen victim artifactsIP address185.117.72.215Historical resolution for resumeacceptable.comIP address185.45.193.151Historical resolution for publisherresolution.comIP address50.114.167.112Historical resolution for simultaneouslypower.comDomainitemrange.comHistorical EtherRAT C2 domain from the Ethereum contractDomainwiselystarting.comHistorical EtherRAT C2 domain from the Ethereum contractDomainsimultaneouslypower.comHistorical EtherRAT C2 domain from the Ethereum contractDomainresumeacceptable.comHistorical EtherRAT C2 domain from the Ethereum contractDomainpublisherresolution.comHistorical EtherRAT C2 domain from the Ethereum contractURLhxxp://193.233.202.17:42718/task39.ps1PowerShell payload download locationURLhxxp://193.233.202.17:8088/slvbeaconsc.binSliver shellcode download locationURLhxxps://193.233.202.17Sliver C2 endpointEthereum contract0xb3f2897f2bc797e5b9033faef8c81e92b01cb831EtherRAT C2 resolver contractEthereum lookup key0x40b57c3622c1CbfD699207F71F2dE5A8Fe256893Smart-contract lookup keyHTTP headerX-Bot-ServerEtherRAT network detection indicatorFile nameconsc1.0.1.msiEtherRAT installer deployed by remote scheduled tasksSHA-256EE6807A8ABFABCED22EE026E178A28DA64D13CC3408E224394FF6E5782FB9E1DHash of consc1.0.1.msiFile namejEdb5ROX.cmdNode.js bootstrapper installed by the EtherRAT MSISHA-256F659681525DEBDA69FE0865B2B27A42F684B1FDA66AA7398E80B84CC765C73C7Hash of jEdb5ROX.cmdFile nameYUGKag9mvNKWylo.binEtherRAT decoder and Run-key persistence componentSHA-2567567994310A9576B1F98DC672ECFA038F1D65084315F59E3883F9B6F24000073Hash of YUGKag9mvNKWylo.binFile namejlfYWzAkN99jpGu.xmlXOR-encrypted EtherRAT backdoorSHA-25673955566338ADFFB423C3B7608792963080DA780E8B7B2C2CD6B6B0CEF6F217FHash of jlfYWzAkN99jpGu.xmlFile nameBDQbS2lZ6u.bakDecoded Node.js EtherRAT payloadSHA-25686881B8E9D197AC2F734792DE48D5DFAEBE7CAFB6E35D49C5DD7FE6EB697230EHash of BDQbS2lZ6u.bakFile nametask39.ps1Account creation, defence impairment, hive theft, tunnelling, and reverse-shell scriptHashF609621698EAAD8C4683750FE8BD0E2423Hash listed for task39.ps1File nameslvbeaconsc.binSGN/Donut-packed Sliver beacon shellcodeSHA-256FB94688ED37DFCB985A8A4D720230E5150956E1788D579B0A54B53A153FD2F2EHash of slvbeaconsc.binFile nameVOCATIONALGORILLASliver implant extracted from shellcodeSHA-256C7A80576FBD25057435652788591D13998DA272EDF627FC29D296684CEFC50E5Hash of extracted Sliver implantFile namesvchostupdate.exeStandalone Garble-obfuscated Sliver implantSHA-256BD61C2880920BBFB86C12DF439DD1CA0258A10E532433698FD029AEF2A5B33F2Hash of svchostupdate.exeFile namesupdate.exe, wsstable.exeDuplicate multi-controller Go reverse shellsSHA-256F4C87A1DF04274B7497CBF9A4619B946C915CF5210B6E2EAA2FEE1629F4FF196Hash of the duplicate Go reverse-shell binariesFile namews3srv.exeMulti-controller Go reverse shellSHA-256756C2096F54C5497110C9D854625C3ED592873E566D532077CD7ADB4D10D4ADDHash of ws3srv.exeScheduled-task namesWinSvcUpdate2, WindowsUpdSvc31, WindowsUpdateSvc, SysUpdateMalicious remote scheduled-task namesFile pathC:\upd.exeGo reverse shell staged by task39.ps1File pathC:\37.exePrivileged reverse shell launched by getsys.exeArtifactAPPDATA.logEtherRAT runtime logArtifactAPPDATA.nodebotidEtherRAT configuration and bot identifierRegistry artifactHKCU Run keyEtherRAT persistence locationCredentialsupport2 : Supp0rt22026!Account credentials created or used by intrusion tooling
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN
The post Remote Scheduled Tasks Spread EtherRAT Across Compromised Windows Domain appeared first on Cyber Security News.
