EtherRAT Spreads via Scheduled Tasks in Compromised Windows Domains
Key Takeaways EtherRAT, a sophisticated Node.js-based remote access trojan, is being deployed in Windows domains. The threat actor, an affiliate of The Gentlemen ransomware group, leverages remote...
Key Takeaways
- EtherRAT, a sophisticated Node.js-based remote access trojan, is being deployed in Windows domains.
- The threat actor, an affiliate of The Gentlemen ransomware group, leverages remote scheduled tasks for widespread lateral movement.
- Initial compromise leads to the deployment of malicious installers, establishing persistence and multiple backdoors.
- EtherRAT utilizes an Ethereum smart contract for dynamic Command and Control (C2) infrastructure, complicating detection and takedown efforts.
- Organizations with compromised Windows domain administrator accounts face a high risk of rapid, extensive network disruption.
A new campaign involving the EtherRAT remote access trojan has been identified within compromised Windows domains. This activity, attributed to an affiliate of The Gentlemen ransomware operation, highlights how a single point of entry can rapidly escalate into a pervasive network compromise when attackers achieve elevated privileges.
Table Of Content
The attackers exploited remote scheduled tasks to propagate malicious installer packages across the network. These installers then deployed EtherRAT, a Node.js-based remote access tool designed for command execution, credential theft, and persistent access following the initial breach. The sophisticated use of blockchain technology for its Command and Control (C2) infrastructure further complicates efforts to track and neutralize the threat.
Analysts at Hunt.io uncovered this intricate operation after discovering an exposed directory on a server utilized during the intrusion. This repository contained a trove of operational data, including scripts, task configurations, installers, tunneling tools, and reverse shells, providing an unprecedented look into the attacker’s toolkit and tactics.
Hunt.io shared insights from their report with Cyber Security News (CSN), stating that the evidence points to a deliberate strategy of establishing multiple enduring access routes into victim environments. Concurrently, the attackers focused on harvesting credentials and Active Directory information. This approach significantly increases the potential for widespread system disruption, especially since a compromised administrator account can quickly grant attackers comprehensive control over an entire domain. Similar ransomware attacks targeting Windows domains have previously leveraged this same advantage.
Remote Scheduled Tasks Spread EtherRAT
The attackers employed a multi-pronged approach to reach internal hosts, utilizing administrative shares, Windows Management Instrumentation (WMI), and remote task registration. They copied payloads to target machines via scripts and then created scheduled tasks with benign-sounding names such as “WinSvcUpdate2” and “WindowsUpdSvc” to blend in with legitimate system activity. This tactic underscores that Windows task scheduler abuse is a viable method for both persistence and lateral movement.
One particular scheduled task, executed under the powerful SYSTEM account, downloaded a PowerShell script from a staging server. This script was designed to perform a series of malicious actions: creating a local administrator account, attempting to add it to Domain Admins, disabling crucial security services, exfiltrating registry hives, and setting up a tunnel for remote access. The attackers also staged additional reverse-shell tooling, ensuring redundant access pathways in case primary methods failed.
The deployment scripts utilized legitimate Windows utilities like certutil.exe to retrieve an MSI package, then silently installed it using msiexec.exe. An alternative method involved copying the installer via Server Message Block (SMB). This blend of native tools and administrative privileges can easily mimic normal system operations, making detection challenging without rigorous monitoring of task-creation events, unusual remote share writes, and unexpected processes launched by the task scheduler.
The recovered files unequivocally linked this activity to the Gentlemen cluster. While the attribution remains an assessment, the consistent tooling, installer naming conventions, and shared infrastructure provide a robust framework for defenders to investigate related incidents.
Blockchain C2 Extends Access
Upon installation, EtherRAT decrypts a JavaScript backdoor and establishes a Run-key entry to ensure persistence across user logins. If Node.js is not present on the system, the installer first downloads the necessary runtime. The malware then attempts to evade detection by disguising its web requests with randomized paths and common file extensions while actively polling for new instructions.
A distinctive characteristic of EtherRAT is its dynamic C2 infrastructure. Instead of embedding a fixed command server address, the RAT queries an Ethereum smart contract to retrieve its current C2 domain. This innovative approach allows operators to alter their C2 destination without needing to update or redeploy the malware implant. Conversely, investigators can analyze the contract’s transaction history to trace previous C2 domains. Previous reports on EtherRAT’s malicious MSI installers have previously indicated the malware’s increasing focus on Windows environments.
Any server response exceeding ten characters is interpreted as JavaScript and executed by the implant. This provides the operator with a highly flexible mechanism to execute commands, access files, launch processes, interact with the network, or download new payloads, all without a predefined feature set. The presence of a custom “X-Bot-Server” HTTP header serves as a critical detection indicator for security teams.
What You Should Do
- Review Scheduled Tasks: Immediately investigate any remotely created scheduled tasks, especially those running with SYSTEM privileges or invoking PowerShell, certutil, msiexec, or executables from unusual file paths.
- Monitor Privileged Accounts: Scrutinize the creation of new privileged accounts and any modifications to existing security services.
- Analyze Network Traffic: Look for outbound connections to public Ethereum RPC services (e.g., Infura, Alchemy) and any communications with the Command and Control infrastructure listed in the Indicators of Compromise below.
- Contain and Remediate: If an infection is suspected, isolate affected hosts, reset any compromised credentials, and check for persistence mechanisms, particularly in the HKCU Run key, to prevent further spread.
- Implement Strong Authentication: Enforce multi-factor authentication (MFA) for all administrative accounts and critical systems to mitigate the impact of stolen credentials.
- Regularly Update and Patch: Ensure all operating systems and software are kept up-to-date with the latest security patches to reduce the attack surface.
- Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious process activity, unauthorized script execution, and unusual network connections.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| IP address | 193.233.202.17 | Primary staging, C2, Sliver, tunnelling, and registry-hive exfiltration server |
| IP address | 146.103.127.44 | Secondary controller embedded in Go reverse-shell binaries |
| IP address | 77.110.126.46 | Secondary controller embedded in Go reverse-shell binaries |
| IP address | 77.110.122.137 | Case-observed Gentlemen infrastructure |
| IP address | 77.110.122.58 | Staging server associated with cons1.0.1.msi |
| IP address | 38.110.228.43 | Historical resolution for wiselystarting.com |
| IP address | 38.110.228.125 | Historical resolution for itemrange.com |
| IP address | 38.110.228.33 | Open directory containing disclosed Gentlemen victim artifacts |
| IP address | 185.117.72.215 | Historical resolution for resumeacceptable.com |
| IP address | 185.45.193.151 | Historical resolution for publisherresolution.com |
| IP address | 50.114.167.112 | Historical resolution for simultaneouslypower.com |
| Domain | <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/20fe3e06-078b-41f8-9508-623bd9da4d7e/Remote-Scheduled-Tasks-Spread-EtherRAT-Across-Compromised-Windows-Domain.pdf?AWSAccessKeyId=ASIA2F3EMEYEYYT23OER&Signature=4G7DNnYk6U6FMh%2FHG6bqCACiNRE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEFkaCXVzLWVhc3QtMSJGMEQCIAXoF5eoqTgdyaW1zXk3CeEfkTe6tfeeiENcQQgg%2Bj1IAiB7viQefrS%2FC762P5mJWksCIjuUYahWl4OxuUYCwaI71irzBAgiEAEaDDY5OTc1MzMwOTcwNSIMZW3ZciSf6zazXLlhKtAE6%2FvM9wxb6Rl1xt6Hks7xgdtD3AfB3cNEq1XZQSCk9kQH73QURk3dYX8uJRuoU%2F5whTHhTCOBvaH%2BXOzBEs2LIN0xfRssitFQkHB%2FiSmJx4H0QD2W%2FhjASFv4aAqiNlh1ctxAroIpdGBNtkdO%2BapVZOXkEDB5Seb8J7FDs6wBaZS6JNddR6ipHmAvZjZfMCkk%2BFoWsmSuXdAsM5xhPdZci9qwn7mEIP1guqyaczxA37q6ssjf5Md5ElM7FOnkYEV2oUfcxRrMdN9docTMiwoF5Y9p%2BV6jy7aGCIcdqtzxz1ALoJ178oQj3uWh%2FvO%2FAogZYHMk7E6kIZRTktlpvu4ev0nXOUkCqWugNn8YF1EokF8qBze9wj3k8Lee5qsUzDBpItFanO%2FYZIVlPiQj1F6aD4TmuVHp0c5QG60npNERTG4mVxPEF%2FAArj901XnwdeOdgC7NBol4LD1JmmYSuLXznSEPpKIazcmPo2MOyMU4WU6aQrXLZaMQNNZtFNVff52qyaJIloJcawkmKNK4GQ8LkM5dhjHLS6hPu1dMUZ516xrSJ57XIOpFiyhENDbWRu2ryti8DyyaKfz4WNn0OYMg3RgeIIBSddf6qSWZgHWPbRl6DE8PEgO%2Bo93yi8jWBpOyJPwSD%2F0UPM%2FLffSUtJmIzczlDxNRodqHiE1inziDF%2BXqm29z6S3IidOtC4BHKhGmvm8%2BVh7nE3aeOG1wvt0GIhayBQN%2Bwk%2FS
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.