Remote Scheduled Tasks Spread EtherRAT Across Compromised Windows Domain

A Hunt.io analysis attributes a Windows domain intrusion to a Gentlemen ransomware affiliate that deployed EtherRAT via remote scheduled tasks and MSI installers; the RAT uses blockchain-based C2 resolution, steals credentials and Active Directory data, and the report includes detailed TTPs, IoCs (IPs, domains, filenames, hashes, Ethereum contract), and remediation/detection recommendations.