Remote Scheduled Tasks Spread EtherRAT Across Compromised Windows Domain

EtherRAT has surfaced in a Windows domain intrusion tied to an affiliate of the Gentlemen ransomware operation. The campaign shows how a single foothold can become a network-wide problem when attackers gain privileged access.

The operators used remote scheduled tasks to push malicious installer packages to other systems.

Those installers deployed EtherRAT, a remote access tool built around Node.js that can receive instructions, steal access, and keep running after the initial compromise.

Recent reporting on EtherRAT blockchain hiding techniques shows why this design can make tracking its infrastructure harder.

Analysts at Hunt.io identified the activity after finding an exposed directory on a server used during the intrusion.

The collection contained scripts, task configurations, installers, tunnelling tools, and reverse shells, offering an unusually detailed view of an active operator toolkit.

Hunt.io said in a report shared with Cyber Security News (CSN) that the evidence points to an effort to preserve several routes back into a victim environment while collecting credentials and Active Directory data.

That combination raises the risk of rapid disruption across connected systems, particularly because one compromised administrator account can turn into broad domain control.

Similar ransomware attacks targeting Windows domains have relied on the same advantage.

Remote Scheduled Tasks Spread EtherRAT

The attackers used administrative shares, Windows Management Instrumentation, and remote task registration to reach internal hosts.

Scripts copied payloads to remote machines, then created tasks with names such as WinSvcUpdate2 and WindowsUpdSvc to make the activity appear routine.

This is a practical reminder that Windows task scheduler abuse is not only a persistence trick, but also a delivery method for lateral movement.

One task ran under the SYSTEM account and downloaded a PowerShell script from the staging server.

The script created a local administrator account, attempted to add it to Domain Admins, disabled security services, exported registry hives, and set up a tunnel for remote access.

It also staged reverse-shell tooling, giving the operator backup options if one access route failed.

The deployment scripts used certutil.exe, a legitimate Windows utility, to retrieve an MSI package, then invoked msiexec.exe to install it quietly.

A fallback path copied the installer through SMB. This blend of built-in tools and administrative access can look like ordinary system work unless teams review task-creation events, unusual remote share writes, and unexpected processes launched through task scheduler.

The recovered files linked the activity to the Gentlemen cluster. The attribution is an assessment, but the shared tooling, installer naming, and infrastructure provide strong context for defenders investigating related incidents.

Blockchain C2 Extends Access

After installation, EtherRAT decrypts a JavaScript backdoor and establishes a Run-key entry so it launches again when the user signs in.

If Node.js is unavailable, the installer downloads a runtime first. The malware then disguises its web requests with random paths and common-looking file extensions while polling for instructions.

Its most distinctive feature is where it finds its command server. Instead of keeping a single address inside the malware, EtherRAT queries an Ethereum smart contract for the current domain.

The operator can change that destination without replacing the implant, while investigators can examine the contract history to reconstruct earlier domains. Earlier coverage of EtherRAT malicious MSI installers documented the malware’s growing Windows focus.

Any server response longer than ten characters can be treated as JavaScript and executed by the implant.

That gives the operator a flexible way to run commands, access files, start processes, contact the network, or pull in new payloads without a fixed feature set. The custom X-Bot-Server HTTP header is a useful detection clue for security teams.

Defenders should urgently review scheduled tasks created remotely, especially those running as SYSTEM or calling PowerShell, certutil, msiexec, or files outside normal application paths.

They should also investigate new privileged accounts, security-service changes, outbound traffic to public Ethereum RPC services, and connections to the infrastructure listed below.

Isolating affected hosts, resetting exposed credentials, and checking for Run-key persistence can help contain a suspected spread before it reaches more systems.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN