EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades

Atos TRC describes an active, highly-resilient campaign that uses SEO-poisoned GitHub facade repositories to distribute malicious MSI installers impersonating admin tools (e.g., PsExec, AzCopy, Sysmon, LAPS). The payload, identified as EtherRAT, is a multi-stage Node.js RAT that loads in-memory, establishes persistence via registry Run keys, and resolves its C2 dynamically from an Ethereum smart contract queried through public RPC endpoints—enabling rapid C2 rotation and robust takedown resistance. The campaign specifically targets high-privilege enterprise administrators and DevOps engineers, has deployed dozens of facade repositories, includes multiple variants and IoCs, and the report provides detection and mitigation recommendations (block ETH RPCs, retrospective log review, tool provenance checks, and behavioral hunting).