Back Gbhackers

Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns

Gbhackers •Mayura Kathir • April 1, 2026

Hackers are abusing the Ethereum blockchain to hide and control a new Node.js backdoor called EtherRAT, using a stealthy technique known as EtherHiding to make their command‑and‑control (C2) infrastructure difficult to disrupt. EtherRAT, previously profiled by Sysdig and linked to North Korean “Contagious Interview” activity, is a Node.js backdoor that lets attackers run arbitrary commands, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EtherRAT Malware Campaign Exploits Ethereum for Stealthy Attacks Hackers are leveraging the Ethereum blockchain to deploy a sophisticated Node.js backdoor known as EtherRAT, utilizing a technique called EtherHiding to obscure their command-and-control (C2) infrastructure. This malware allows attackers to execute arbitrary commands on compromised systems, posing a significant risk to organizations across various sectors. EtherRAT has been linked to North Korean cyber operations, specifically the 'Contagious Interview' activity. The stealthy nature of EtherHiding complicates detection and mitigation efforts, making it challenging for cybersecurity professionals to respond effectively. Current reports indicate that EtherRAT is actively targeting multiple organizations, with the potential for widespread impact. The ongoing campaign highlights the evolving tactics used by cybercriminals to exploit blockchain technology for malicious purposes. 2 sources 71

Extracted Entities

Ethereum-Based EtherRAT, EtherHiding Power Stealthy Malware Campaigns

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)