Etherrat Nextjs Exploitation And Worm Propagation

nomit vyas@xoxo

•updated Jan 29, 2026•1•0•110

Detects exploitation attempts and worm-like scanning behavior targeting Next.js applications, characteristic of the EtherRAT malware. The rule identifies web requests with the 'x-middleware-subrequest' header (CVE-2025-29927) or scanning of sensitive paths like '/_next/data/' from internal sources.