EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades
Summary: Atos Threat Research Center documented a campaign, active from early December 2025 through April 1, 2026, that used SEO poisoning on Bing, Yahoo, DuckDuckGo, and Yandex to rank fake GitHub repositories for IT administration tools such as PsExec, AzCopy, Sysmon, LAPS, and Kusto Explorer, with 44 separate facade repositories deployed in that period. The facades held no malware and linked to a second hidden GitHub repository hosting malicious MSI installers that deploy an EtherRAT variant written in JavaScript, which retrieves its command-and-control address from a hardcoded Ethereum smart contract rather than a fixed domain or IP.
Key Takeaway: The lures are the tools administrators and defenders use to investigate incidents, so a single install on a privileged workstation can hand over what the source calls the keys to the kingdom, and because the C2 address lives on the Ethereum blockchain there is no domain or IP to blocklist.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026