Ransomware Operators Hide Command Servers Inside Ethereum Smart Contracts

Ransomware operators are evolving their tactics by hiding malware command servers inside Ethereum smart contracts. One Gentlemen ransomware affiliate has been using the EtherRAT backdoor to pull rotating C2 domains directly from the blockchain.

The toolkit used by this affiliate shows a clear progression, starting with scheduled tasks that bootstrap PowerShell and create privileged accounts. It also includes LSASS and registry-hive dumping, ESET service tampering, and multiple tunneling and reverse-shell payloads staged for lateral movement and eventual ransomware deployment.

At the core of this campaign is EtherRAT, a Node.js-based remote access trojan delivered via MSI payloads and deployed at scale via remote scheduled tasks. Instead of embedding fixed infrastructure, EtherRAT hardcodes an Ethereum smart contract lookup key, and selector, then queries a pool of public Ethereum RPC endpoints to resolve its current C2 domain.

Every C2 rotation is written permanently on-chain, giving operators cheap, takedown-resistant agility while handing defenders a historical ledger of all prior domains. The exposed open directory on 193.233.202[.]17 captured a Gentlemen ransomware affiliate mid-operation, exposing 82 local artifacts that reconstruct the full intrusion chain against a Windows domain.