EtherRAT SYS_INFO and EtherHiding C2 Activity

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•1•0•189

Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).