Malicious Infrastructure Exposed: EtherRAT, Phishing, and Malware Distribution

Don't have an account? Sign up

Recently, we uncovered a vast malicious infrastructure distributing malware, malicious documents, remote desktop software, and phishing pages. The infrastructure was linked to a strange homepage that caught our attention.

EtherRAT is a RAT developed in Node.js that allows an attacker to gain complete control over the machine and execute arbitrary code returned by the Command and Control (C2) server. The malware uses the Ethereum blockchain to obtain the C2 server, making it more resilient to infrastructure takedowns.

While threat hunting, we found an open directory distributing MSI installers and PowerShell scripts, which ultimately distributed EtherRAT. In the analyzed cases, the PowerShell scripts and MSI installers were distributed from a '/install' folder. The versions have a progressive number, ranging from v1 to v10.

The returned home page caught our attention and prompted us to further explore the campaign.

Analyzing domains and associated IPs with the EtherRAT distribution, we detected other similar home pages with a hacking-style theme. These websites appeared to belong to a larger distribution chain, which also distributes phishing, remote control software, and other malware.

Interestingly, the majority of the domains related to this malicious infrastructure in the past also returned an HTML page related to a 'Bulletproof Infrastructure' service.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser >

Gabriele is a Malware Research Engineer who loves fighting malware. When he's not doing that, you’ll find him enjoying nature, art, and animals.