Executive Summary
In March 2026, a sophisticated campaign involving EtherRAT, a Node.js-based backdoor, was identified targeting the retail sector. Attributed to North Korean threat actors and showing overlaps with MuddyWater TTPs, the malware leverages a technique known as 'EtherHiding.' This involves using Ethereum smart contract input data to store and update Command-and-Control (C2) addresses, providing the attackers with a decentralized, takedown-proof mechanism for infrastructure rotation.
The attack chain typically begins with 'ClickFix' lures or IT support scams conducted via Microsoft Teams and QuickAssist. Once executed, the malware deploys a multi-stage Node.js stager that establishes persistence through the Windows Registry. It then fetches a module dubbed 'SYS_INFO' to perform exhaustive system fingerprinting, including hardware IDs, GPU details, and antivirus configurations, specifically checking for CIS-related languages to avoid targets in certain regions.
This threat is significant due to its use of blockchain technology for C2 resilience and its ability to blend into legitimate network traffic using CDN-like beaconing patterns. The integration with the 'Tsundere' botnet and the use of advanced JavaScript obfuscation (Obfuscator.io) highlight a maturing ecosystem of cross-platform, Node.js-based malware designed for cryptocurrency and credential theft.