In a recent cyber intrusion incident, EtherRAT has emerged as a threat within a Windows domain, attributed to an affiliate of the Gentlemen ransomware group. This situation demonstrates how attackers can exploit a single access point to compromise an entire network when they obtain elevated privileges.
Remote Tasks as a Vector for EtherRAT
The attackers utilized remote scheduled tasks to disseminate harmful installer packages across various systems. These packages installed EtherRAT, a remote access tool based on Node.js, capable of executing commands, exfiltrating data, and maintaining persistence post-compromise.
Hunt.io analysts uncovered these activities by discovering an exposed directory on a server involved in the attack. The directory contained scripts, task configurations, and other tools, providing a rare insight into the tactics and tools of active threat actors.
Detailed Analysis of the Attack Strategy
Hunt.io’s report, shared with Cyber Security News, indicates a strategic approach to infiltrate victim environments while gathering credentials and Active Directory data. The use of administrative shares, Windows Management Instrumentation, and remote task registration allowed the attackers to reach internal hosts efficiently.
Scripts were employed to transfer payloads to remote machines, creating tasks with innocuous names like WinSvcUpdate2 to disguise malicious activities. This highlights how the abuse of Windows task scheduler can serve both as a persistence mechanism and a means for lateral network movement.
Decoding EtherRAT’s Malware Infrastructure
Post-installation, EtherRAT decrypts a JavaScript backdoor and sets up a Run-key entry for automatic execution upon user login. If Node.js is not present, a runtime is downloaded first. The malware then masks its web requests with random paths, complicating detection efforts.
Uniquely, EtherRAT queries an Ethereum smart contract to determine its command server, allowing for dynamic changes without altering the malware itself. This method complicates tracking but provides investigators a trail via contract history.
Security teams are urged to review remotely created scheduled tasks, especially those running as SYSTEM or invoking PowerShell, certutil, msiexec, or operating outside normal paths. Identifying and isolating affected systems, resetting compromised credentials, and checking for persistent Run-key entries are critical steps to mitigate further spread.
For detailed indicators of compromise and further technical analysis, refer to the full report and resources provided by Hunt.io and Cyber Security News.
