Gentlemen Affiliate Leverages EtherRAT via Ethereum Smart Contract

Researchers have discovered a detailed intrusion toolkit linked to a suspected affiliate of The Gentlemen ransomware operation. An exposed directory on 193.233.202[.]17 contained 82 files totaling about 145 MB, revealing an operator's preparations to gain long-term access to Windows networks and steal credentials.

The recovered files show the actor relying heavily on Windows scheduled tasks to execute PowerShell scripts remotely and deploy payloads on internal systems. One task, task39.xml, ran under the SYSTEM account and downloaded a script from the staging server, which created a local administrator account, added it to Remote Desktop Users, and attempted to place it in the Domain Admins group.

The operation used living-off-the-land binaries to avoid relying only on custom malware. Scripts attempted to reach internal hosts through administrative SMB shares and Windows Management Instrumentation, copying payloads to remote systems, creating scheduled tasks, and using fallback methods when direct deployment failed. The key payload was EtherRAT, a Node.js-based implant installed through an MSI package.

EtherRAT is notable because it does not store a fixed C2 domain inside the malware. Instead, it queries an Ethereum smart contract through public RPC services to retrieve its active C2 address. Researchers reconstructed five historical EtherRAT domains, including publisherresolution[.]com and simultaneouslypower[.]com.