Takedown-Proof: Inside the Ethereum-Powered “EtherRAT” and North Korea’s New Blockchain Backdoor

eSentire's TRU detected a sophisticated EtherRAT campaign targeting the retail sector: a Node.js backdoor linked to North Korean APT actors that uses Teams-based social engineering for initial access and stores/upates C2 via Ethereum smart contracts to make infrastructure takedown-resistant; the malware employs LOLBin execution, encrypted multi-stage payloads, registry persistence, extensive fingerprinting, and a CIS-language kill-switch.