EtherRAT - Initial Access, Execution, Persistence and RMM installation

Canister -@Canister

•updated May 15, 2026•24•2•1,050

Attackers distributed a malicious MSI installer disguised as a legitimate Sysinternals tool. Once executed, it installed EtherRAT, a Node.js-based remote access trojan. EtherRAT then deployed TukTuk C2, a framework designed to abuse SaaS services (Supabase, ClickHouse, Dropbox, GitHub Issues) and Cloudflare tunnels for resilient command-and-control. https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/