{"id":4977,"date":"2026-03-26T16:36:48","date_gmt":"2026-03-26T16:36:48","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2026\/03\/26\/etherrat-techniques-bypass-security-via-ethereum-smart-contracts\/"},"modified":"2026-03-26T16:36:48","modified_gmt":"2026-03-26T16:36:48","slug":"etherrat-techniques-bypass-security-via-ethereum-smart-contracts","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2026\/03\/26\/etherrat-techniques-bypass-security-via-ethereum-smart-contracts\/","title":{"rendered":"EtherRAT Techniques Bypass Security Via Ethereum Smart Contracts"},"content":{"rendered":"
\n

A new EtherRAT malware campaign using Ethereum smart contracts to hide command-and-control (C2) infrastructure has been identified by researchers.<\/p>\n

According to a new advisory published by eSentire on March 25, the activity was observed during a March 2026 incident response investigation in the retail sector, where adversaries deployed a Node.js\u2011based backdoor after gaining initial access.<\/p>\n

The researchers found the malware enables attackers to execute commands remotely, collect extensive system data and steal cryptocurrency wallets and cloud credentials.<\/p>\n

The most notable development is the use of a technique known as EtherHiding, which stores C2 addresses inside Ethereum smart contracts, allowing operators to rotate infrastructure cheaply and avoid traditional takedown efforts.<\/p>\n

Ethereum Smart Contracts Used For Command Infrastructure<\/strong><\/h2>\n

Investigators observed several methods used to gain initial access, including ClickFix attacks and IT support scams conducted over Microsoft Teams, followed by QuickAssist remote access.<\/p>\n

In the ClickFix case, attackers used indirect command execution to launch a malicious script through Windows utilities, bypassing security restrictions.<\/p>\n

The infection chain involved multiple stages, including encrypted payloads and obfuscated scripts that ultimately deployed EtherRAT and established persistence through Windows registry keys.<\/p>\n

Once installed, EtherRAT retrieved\u00a0C2 addresses from Ethereum blockchain smart contracts via public RPC providers. The malware then communicated\u00a0with the server using traffic designed to resemble normal content delivery network requests, helping it blend into legitimate network activity.<\/p>\n

Read more on Ethereum smart contracts and malware infrastructure: Malicious npm Packages Exploit Ethereum Smart Contracts<\/em><\/p>\n

eSentire said attackers could update C2 addresses by writing new data to the smart contract, allowing previously infected machines to reconnect to new servers with minimal cost.<\/p>\n

System Fingerprinting and Data Collection<\/strong><\/h2>\n

After connecting to its command server, the malware deployed\u00a0a module that collected\u00a0detailed system information used for target profiling. This includes:<\/p>\n