Ransomware Hackers Are Hiding Malware Command Servers Inside Ethereum Smart Contracts

This report details an active Gentlemen ransomware affiliate operation that deploys a Node.js backdoor (EtherRAT) via MSI and scheduled tasks, uses Ethereum smart contracts to publish rotating C2 domains for resilient, takedown-resistant command-and-control, and leverages Sliver, Go-based reverse shells, and tunneling tools for lateral movement and exfiltration; Hunt.io captured extensive artifacts from exposed open directories tying multiple IPs/ASNs to the campaign and listing detailed IOCs.