Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software 

This report details an active malicious infrastructure distributing EtherRAT — a lightweight Node.js remote access trojan that uses the Ethereum blockchain to obtain C2 endpoints — via MSI installers, PowerShell and JavaScript loaders; it describes loader behavior, custom decryption algorithms, persistence mechanisms, C2 polling formats, related phishing kits, exposed open directories, and provides IPs and domains observed in the campaign.