Ethereum Smart Contracts Used as Stealthy Command-and-Control Resolvers

Ransomware hackers have found a new way to evade detection by hiding their command servers inside Ethereum smart contracts, according to researchers at Hunt.io. The Gentlemen ransomware affiliate is using the EtherRAT backdoor to pull rotating C2 domains directly from the blockchain instead of hardcoding them in the malware.

The toolkit shows a progression of malicious activities, including scheduled tasks that bootstrap PowerShell, privileged account creation, and multiple tunneling and reverse-shell payloads staged for lateral movement and eventual ransomware deployment.

EtherRAT is delivered via MSI payloads and deployed at scale via remote scheduled tasks. It establishes Run-key persistence under 'WindowsHost,' launching its payload via conhost.exe in headless mode.