The Gentlemen Ransomware Deploys EtherRAT: Ethereum Smart Contract Powers Stealth C2

A misconfigured server left wide open on the internet just handed defenders a rare, unfiltered look inside an active ransomware intrusion, revealing a technique that should worry every blue team watching for the next domain-wide encryption event.

Hunt researchers tracking infrastructure tied to The Gentlemen ransomware operation discovered an exposed open directory at 193.233.202[.]17, catching an affiliate mid-operation as it built out persistent access across a Windows domain.

Inside was a full operator toolkit: 82 recovered files totaling 145 MB, including 37 Windows executables, 22 PowerShell scripts, 9 batch files, 6 scheduled-task XML files, and 1 especially notable payload: EtherRAT, a backdoor that resolves its command-and-control domain from an Ethereum smart contract instead of a hardcoded address.

The Gentlemen Ransomware Deploys EtherRAT

Deployment leaned heavily on living-off-the-land binaries. The operator used certutil.exe to fetch payloads onto remote hosts and msiexec.exe to install them silently, hiding the activity under scheduled tasks named WinSvcUpdate2 and WindowsUpdSvc.

Before spreading domain-wide, the actor created a rogue local administrator account, added it to the Administrators and Remote Desktop Users groups, and attempted to escalate to Domain Admins.

Defensive evasion followed, disabling ESET-related services via sc.exe, alongside registry-hive exfiltration, LSASS dumping, and a stacked arsenal of Potato-family privilege-escalation tools, including Mimikatz, JuicyPotato, PrintSpoofer, and GodPotato.

The centerpiece of the intrusion is EtherRAT itself. Delivered via a Node.js bootstrapper dropped by the MSI, the malware queries a smart contract on the Ethereum mainnet using hardcoded contract and lookup-key addresses, along with a function selector, to retrieve its live command server.

Seven separate public RPC endpoints provide redundancy, so the malware never relies on a single blockchain gateway to resolve its C2.

This lets the operator rotate infrastructure freely without ever touching the implant itself. The trade-off favors defenders: every domain update is permanently written to the blockchain, allowing researchers to reconstruct the entire historical C2 timeline five rotating domains in this case, spanning April through July.

EtherRAT’s command structure is unusually open-ended. Any server response longer than 10 characters is treated as raw JavaScript and executed in the malware’s Node.js runtime, allowing the operator to run arbitrary code without updating the backdoor to add new capabilities.

Traffic mimics innocuous static-file requests, but a distinctive X-Bot-Server HTTP header offers a reliable detection point. EtherRAT wasn’t the only lifeline. The directory also revealed Sliver beacon shellcode, Go-compiled reverse-shell binaries, and a Chisel-based SOCKS proxy a deliberate strategy of stacking independent command channels so losing one doesn’t end the intrusion.

Hunt stated that pivoting off the Go binaries revealed two additional controller IPs that share the staging server’s autonomous system.

A second, nearly identical EtherRAT cluster used the same smart contract and a near-duplicate MSI filename, while a separate directory flagged by Gambit Security tied artifacts to a U.S.-based Gentlemen victim disclosed roughly a month later, reinforcing that this activity likely traces back to the same cluster, including an earlier unattributed ClickFix campaign.

Blockchain-hosted C2, sometimes called EtherHiding, is gaining traction because it’s cheap, censorship-resistant, and hard to disrupt through domain seizure.

Security teams should treat unusual scheduled-task names, certutil or msiexec chains fetching remote packages, and outbound traffic carrying an X-Bot-Server header as high-priority detection triggers, regardless of which C2 address is active that week.