Back Cybersecuritynews

Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum

Cybersecuritynews •Tushar Subhra Dutta • April 1, 2026

A sophisticated backdoor called EtherRAT is actively targeting organizations across multiple sectors by hiding its command infrastructure inside the Ethereum blockchain — a move that makes it uniquely hard to track and shut down. The malware runs on Node.js and gives attackers full remote control over compromised machines, enabling them to execute commands, steal cryptocurrency […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EtherRAT Malware Campaign Exploits Ethereum for Stealthy Attacks Hackers are leveraging the Ethereum blockchain to deploy a sophisticated Node.js backdoor known as EtherRAT, utilizing a technique called EtherHiding to obscure their command-and-control (C2) infrastructure. This malware allows attackers to execute arbitrary commands on compromised systems, posing a significant risk to organizations across various sectors. EtherRAT has been linked to North Korean cyber operations, specifically the 'Contagious Interview' activity. The stealthy nature of EtherHiding complicates detection and mitigation efforts, making it challenging for cybersecurity professionals to respond effectively. Current reports indicate that EtherRAT is actively targeting multiple organizations, with the potential for widespread impact. The ongoing campaign highlights the evolving tactics used by cybercriminals to exploit blockchain technology for malicious purposes. 2 sources 71

Extracted Entities

Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (2)

MITRE ATT&CK (1)

Tools (1)