EtherRAT brought blockchain-backed C2 into this intrusion. A malicious MSI masquerading as Sysin...

Summary

A malicious MSI installer disguised as Sysinternals RAMMap deployed EtherRAT, a remote access trojan that leverages EtherHiding to retrieve command-and-control configuration updates hosted on the Ethereum blockchain. After initial compromise, the malware pivoted to using TryCloudflare infrastructure for continued command delivery.

Indicators of Compromise

• malware — EtherRAT
• malware — EtherHiding

Entities