EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus
Blockchain technology was built for trustless, decentralized finance. Threat actors found another use for it.EtherRAT is a JavaScript-based remote access trojan that stores its command and control address directly inside an Ethereum smart contract. When the malware needs to phone home, it doesn't reach out to a hardcoded domain that defenders can block. It queries the blockchain, which is publicly accessible, permanently available, and impossible to take down. The operator updates the C2 URL by sending a cheap transaction to the contract. The malware reads it back using a silent, read-only call that leaves no trace on-chain and looks like normal Web3 traffic on the wire.No domain to seize. No server to take offline. No DNS to sinkhole. For $1.37 per update, the operator rotates infrastructure faster than defenders can respond.We went hunting.
The Smart Contract
Everything started at:
0xe26c57b7fa8de030238b0a71b3d063397ac127d3
The contract is unverified on Etherscan. No source code published, no transparency, just raw bytecode. That alone is a red flag for any contract receiving repeated zero-value transactions. What made it more interesting was a note from Etherscan: 23 other contracts share identical bytecode. The same C2 template deployed across multiple campaigns, each serving a separate operator.
The mechanism is simple and effective. Two functions drive the entire operation:
The contract uses a mapping(address => string) structure, meaning each operator wallet gets its own isolated storage slot. The malware calls getString(operatorAddress) and gets back exactly one URL: the active C2. The read happens via eth_call, a read-only query that generates no transaction, no gas cost, no on-chain record. From a network monitoring perspective it is indistinguishable from a legitimate DeFi application querying a public RPC endpoint.
We can see the operator actively rotating C2 domains through the decoded transaction logs:
The Operator Wallet
Every smart contract has a creator. We traced the contract back to its deployer:
0x8D7e3Cc5342439fF28C589a902B685EA4d398C12
The wallet tells a clean story. 22 transactions total, first activity 111 days ago, still active 9 days before this report. The ETH balance sits at just enough to cover gas — this is a purpose-built operator wallet, not a financial one.
What caught our attention immediately was the funding source. The wallet was seeded by ChangeNOW16, a hot wallet belonging to ChangeNOW, a no-KYC instant cryptocurrency exchange requiring zero identity verification. A deliberate choice for someone who doesn't want to be found.
The sequence is exact. ChangeNOW funds the wallet. Minutes later the operator deploys the contract. From that point on, every outbound transaction is a setString() call rotating the active C2 domain.
The wallet has no other activity. No token transfers, no DeFi interactions, no cross-chain activity on BSC or Polygon. It exists for one purpose only: maintaining the C2 contract.
C2 Domains
Decoding every setString() call from the operator wallet gave us the full C2 rotation history. Eight domains were previously known from industry reporting. We found four that had never been published anywhere.
We pivoted on each new domain.
[aabstone[.]com](http://aabstone.com)
Registered March 16, 2026. The VT community flagged it with 14/91 detections, Kill Chain C&C tagged, with Generic Trojan and Adware family labels.
Once the Lazarus Group attribution was established through the identified domain, we turned to the Threat Actor Encyclopedia in the Hokage Intel CTI platform to deepen our understanding of the adversary. The encyclopedia provided a comprehensive profile of the group — covering their known malware families, historically attributed IOCs, exploited vulnerabilities, and documented TTPs. Cross-referencing our findings against this intelligence confirmed strong alignment with Lazarus Group's established patterns of operation, further solidifying the attribution.
Now back to the domain:
The communicating files section is where it gets interesting. A JavaScript file named EtherRAT_Deobfuscated.js was scanned on May 2, 2026, just days before this report, with 23/61 detections. A live EtherRAT sample actively communicating with a domain we found independently.
The MD5 hash of the deobfuscated payload was submitted to the IOC enrichment section, where it returned multiple intelligence hits — directly tying the file to EtherRAT's core functionality, including its Ethereum-based C2 mechanism (EtherHiding), target selection routines, and CDN-like beaconing behavior.
The domain resolved to multiple IPs, with 46.38.156.25 in Finland standing out with a flagged detection.
The JARM fingerprint across aabstone.com came back as:
27d40d40d00040d00042d43d000000d2e61cae37a985f75ecafb81b33ca523We kept that fingerprint in mind.
Searching [twicegrand[.]com](http://twicegrand.com/) on the platform returned a matching intelligence profile, corroborating the earlier findings with consistent Lazarus Group attribution and overlapping C2 indicators.
Registered March 23, 2026, one week after aabstone.com. 7/91 detections on VT.
The passive DNS history showed the domain resolving to 185[.]227[.]144[.]114, ASN 50053 Anton Levin. The same ASN as aabstone.com. That is not a coincidence.
The communicating files on [twicegrand[.]com](http://twicegrand.com) were two:
v114l.exe was labelled as Trojan.EtherRat
ce_v1.ps1 was detected by Google and Ikarus as Trojan-Downloader.PS.EtherRat, explicitly naming the malware family and confirming our attribution directly from the domain.
The dropped files from ce_v1.ps1 painted a clear picture of the lure being used. Node.js package manager files, install_tools.bat, bca516, and persistence components. A victim is told to set up a development environment for a coding test. They run the installer. The infection begins.
The JARM fingerprint on [twicegrand[.]com](http://twicegrand.com/):
27d40d40d00040d00042d43d000000d2e61cae37a985f75ecafb81b33ca523Identical to [aabstone[.]com](http://aabstone.com/).
[ager-stp[.]org](http://ager-stp.org)
Registered April 23, 2026. The most recently registered of our new domains, still being stood up weeks before this report. 1/91 detections on VT, SOCRadar flagging it as malicious, Kill Chain C&C tagged as Generic Trojan.
The domain resolved to 2[.]27[.]120[.]79, ASN 206134 Nekobyte Infoma. A reverse DNS lookup on that IP returned ager-stp.org as the sole domain, tagged malicious with Kill Chain C&C and Generic Trojan labels confirming it as a dedicated C2 host with no legitimate use.
The JARM fingerprint:
27d40d40d00040d00042d43d000000d2e61cae37a985f75ecafb81b33ca523Three domains. Three different IPs. Three different ASNs. One identical JARM fingerprint across all of them.
Registration Fingerprint
Three different domains. Three different IPs. Three different ASNs. But when we pulled WHOIS on all three, the registrant data was byte-for-byte identical.
The registrant fields are fully redacted across all three domains. The operator used Njalla as the DNS provider, an anonymity-focused service that shields the true registrant identity, combined with an offshore registration country in Saint Kitts and Nevis. What gives them away is not the content of those fields but the pattern across them. Same registrar, same nameservers, same country, registered within weeks of each other. Same operator, same tooling, same campaign.This is the campaign fingerprint. Any domain sharing this exact combination of Tucows ID:69, Njalla nameservers and Saint Kitts registration belongs to this operator.
Infection Chain
Pivoting from [twicegrand[.]com](http://twicegrand.com)'s passive DNS record led us to 185[.]227[.]144[.]114, ASN 50053 Anton Levin, the same ASN as [aabstone[.]com](http://aabstone.com).
Two files were communicating with this IP. ce_v1.ps1, which we already confirmed as Trojan-Downloader.PS.EtherRat, and v114l.exe with 23/55 detections.
ce_v1.ps1 dropped multiple files on victim machines, among which notable ones are:
25a144ce9881ebdd.old carried the threat label trojan.etherrat. VT's AI analysis left no ambiguity:
"A sophisticated Remote Access Trojan and Downloader. It uses heavy obfuscation and techniques such as querying the Ethereum blockchain Dead Drop Resolver to find its C2 server. It logs activities to a local file, exfiltrates system identifiers, and implements a persistent loop to fetch and execute arbitrary remote payloads using child_process and dynamic function constructors."
9881ebdd.bin detected as HEUR:Trojan.Script.Generic by Kaspersky.
node_etw_provider.man had three execution parents that revealed the rest of the chain:
build_dARaMELazoQA_8a0f4801-3008-47e4-82f4-546e5e3ea4ee.ps1 — labeled trojan.powershell. Contacted https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip. A legitimate Node.js download used as cover while malicious components execute alongside it.
ssd(2).ps1 — also labeled trojan.powershell, also pulling the same Node.js zip from nodejs.org.
4.ps1 — labeled trojan.powershell/hranb, community tagged as part of the "ether crypto stealer campaign". This is where the chain reaches the backend server. Five URLs contacted, all pointing to one destination:
The nodejs.org download appearing across build_dARaMELazoQA.ps1, ssd(2).ps1 and 4.ps1 is consistent and deliberate. It makes the initial traffic look like a routine developer environment setup. Meanwhile the actual payload chain runs silently in the background.
4.ps1 handed us our next pivot: 91[.]215[.]85[.]42.
Backend Server — 91[.]215[.]85[.]42
4.ps1 handed us the next lead. Every UUID-based URL it contacted pointed to one place: 91[.]215[.]85[.]42. This is the backend server powering the entire operation.
History and Attribution
This server has a documented history of malicious activity stretching back to mid-2024, with recorded labels including Brute Forcer, Web Attacker, Hijacked and Scanner. The intelligence reference tags confirmed what we found independently — etherrat, tsundere and CVE-2025-55182 all tagged on this IP, alongside CVE-2021-4034, the Linux privilege escalation vulnerability known as PwnKit.
CVE-2025-55182 was tagged on this IP as early as December 2025 and connects directly to the React2Shell exploitation technique documented in prior EtherRAT reporting. The operator is not just hosting malware here — they are actively exploiting vulnerabilities to deploy it.
Open Ports
A port scan of the server revealed five open ports, each telling its own story.
Port 3001 is the most significant discovery here. Connecting to it returned a Next.js application titled Tsundere Reborn.
Tsundere is a blockchain-based botnet documented by Kaspersky GReAT in November 2025. Like EtherRAT, it uses Ethereum smart contracts to store and rotate its C2 server address dynamically. Finding Tsundere Reborn running on the same server as our EtherRAT campaign confirms this is shared multi-campaign infrastructure — two blockchain-powered malware families operating side by side on the same bulletproof host, with a PostgreSQL database storing victim data and Redis managing the C2 queue behind them.
C2 Communication Pattern
Port 3000 handles payload delivery. Port 3002 handles direct C2 beaconing. Each victim is assigned a unique session UUID, making individual infection tracking possible server-side.
# Payload delivery — port 3000
http://91.215.85.42:3000/api/{session}/{uuid}/{payload}.png?b={token}
http://91.215.85.42:3000/api/{session}/{uuid}/{payload}.ico?id={token}
http://91.215.85.42:3000/api/{session}/{uuid}/{payload}.css?b={token}
# C2 beaconing — port 3002
http://91.215.85.42:3002/frAQBc8Wsa1xVPfvJc?rgRYwTiizs2trQF69Az={uuid}
http://91.215.85.42:3002/?Blax3CF3EDNhm3soLBP={uuid}
The file extensions are a disguise. There are no images or stylesheets in these responses, only encrypted payloads delivered to already-compromised machines.
Download Samples
Among the 31 request logs recorded against this server, three were direct download links — malware being pulled to victim machines in real time.
18.node — served directly from the server root, this is no ordinary payload. A .node file is a compiled Node.js native addon, executing at a lower level than standard JavaScript and largely invisible to script-based detection.
Multiple vendors flagged it with high confidence — Trojan:Win32/Egairtigado!rfn, Gen:Variant.Tedy.856800, Spyware.Passwordstealer, Trojan.Win64.Spy. The sandbox confirmed anti-VM behavior through CPU count detection, consistent with every other component we found in this chain.
The execution parent was win_files.zip, and the file came packed with 158 bundled files and dropped 222 on execution.
The most alarming bundled file is mimidrv.sys with 60/72 detections — the kernel driver component of Mimikatz, used for deep credential dumping at the kernel level. Several dropped files carried the .mentah extension, Indonesian for "raw", a pattern commonly associated with Southeast Asian threat actor tooling.
The family labels — Tedy, Baicai and SparkRAT — point toward Chinese-speaking threat actors. Tedy and Baicai are Chinese-origin malware families. SparkRAT is an open source Go-based RAT widely used across Chinese-speaking criminal communities.
SpyAgent from /api/reobf/ — the reobf path stands for re-obfuscated. The server generates freshly obfuscated payloads on demand, bypassing static signature detection. This sample dropped __PSScriptPolicyTest files and StartupProfileData, confirming the same persistence mechanism we saw earlier in the infection chain. It also logged PowerShell activity to powershell.exe.log.
Port 3002 UUID download — the starting point was QYPAQFMX.htm, a JavaScript file with 0/61 detections, execution parents being 36170af7...exe (42/61) and a trojanized node binary (37/71).
Investigating 36170af7...exe revealed it contacted 91.215.85.42:3002 directly through the same UUID-based beaconing URLs we had already seen, confirming it as part of the same infection chain.
Its two execution parents were both the same trojanized node binary. Following that node binary opened a new branch of the infrastructure entirely. Labeled trojan.generickdq/capturescreen, it contacted seven URLs spanning three different servers:
http://91.215.85.42:3002/ ← our primary C2
http://91.215.85.42:3002/frAQBc8Wsa1xVPfvJc?... ← UUID beaconing
http://91.215.85.42:3002/?Blax3CF3EDNhm3soLBP=... ← UUID beaconing
http://2.27.28.167/2281/sss.exe ← secondary server
http://2.27.28.167:6062/?id=x-mngs8eyo-o2c ← secondary C2
http://2.27.28.167:6062/?id=x-mnh2uh25-wpn ← secondary C2
http://144.31.238.173:8080/files/52.exe ← third server
The execution parents of this node binary were HydraCheat8.8.3.msi (19/55) and HydraCheat.zip (13/68) — a trojanized gaming cheat tool. This confirmed a third lure type running on the same infrastructure, targeting gamers rather than developers or creative professionals.
The dropped files completed the picture. Among 34 dropped files, Dropbox.exe (22/70) appeared as a trojanized legitimate application used for persistence. client.log and frAQBc8Wsa1xVPfvJc[1].htm — the exact C2 beacon path from port 3002, now saved locally on the victim machine as an HTM file. QYPAQFMX.htm looping back as both a dropped file and our starting point, and .system as a hidden configuration file.
Three Lure Types, One Infrastructure
By this point the picture is clear. This server runs three parallel lure campaigns simultaneously:
Communicating Files
55 files were found communicating with this server across all three campaigns.
Beyond the files already traced through the infection chain, several communicating files on 91[.]215[.]85[.]42 deserve individual attention for what they reveal about the operation's scope.
ss.exe (52/71) — the highest detected file on the server and the most widely distributed payload across the cluster. Identified as Observer, a documented password stealer, it contacts 91[.]215[.]85[.]42:3002 via the same UUID beaconing URLs and makes UDP requests to 239[.]255[.]255[.]250:3702 — Windows WS-Discovery protocol, used for lateral movement by scanning for other devices on the victim network.
Its 11 execution parents reveal every lure campaign feeding into it simultaneously:
- Universe installer.msi and Install_Waves_Central.msi — software piracy lures
- Magix Sony Vegas Pro 23.0.0.302-x64-Repack.zip — piracy lure
- svchost.exe — trojanized system process
- cobalt-strike_icedid_satacom_stealc bundle — multi-family dropper
- node and powershell_core.exe — developer lure chain components
Every lure type, every campaign, every infection chain ultimately delivers the same password stealer.
Desktop.zip (26/66) — labeled trojan.powershell/alien and tagged by the community as part of the ether cryptostealer campaign. This is the initial delivery package handed to victims and it contacts two endpoints:
http://koskelad.com/
http://zx.pe/bp.php
It bundles six files and drops 63 on execution. Among the dropped files, node_etw_provider.man appears — the same file whose execution parents led us through 4.ps1 and into 91[.]215[.]85[.]42 earlier in our investigation. The circle closes here.
2026-03-17_cobalt-strike_icedid_satacom_stealc (49/71) — labeled trojan.midie/misc. Its single execution parent is Install_Waves_Central.msi — the trojanized Waves audio software, confirming the piracy lure campaign delivers Cobalt Strike alongside everything else.
It contacted both 91[.]215[.]85[.]42:3002 and 83[.]217[.]208[.]72:6062 directly, and retrieved ss.exe from 83[.]217[.]208[.]93 — three servers in the cluster communicating through a single file. It dropped ss.exe (52/71), node (37/71), client.log, frAQBc8Wsa1xVPfvJc[1].htm and .system — the same set of artifacts we have now seen dropped consistently across the entire infection chain.
91.215.85_1.42 — a JavaScript file named after its own C2 server. Tagged as trojan, it contacted http://91\[.]215\[.]85\[.]42:3000/88ff96bcda1604d7496622c120b68fb1 directly and dropped the same PowerShell policy test file and StartupProfileData persistence artifacts seen throughout the chain.
Extended Infrastructure
Pivoting through the communicating files of 91.215.85.42 did not lead to a dead end. It led to three more servers.
2[.]27[.]28[.]167 — Secondary Distribution Server
The node binary we traced through the HydraCheat chain contacted two servers — 91[.]215[.]85[.]42 and 2[.]27[.]28[.]167. When we looked up 2[.]27[.]28[.]167, the communicating files were immediately familiar.
Boris FX Sapphire, Maxon Cinema 4D, Universe installer, powershell_core.exe — all files we had already seen on 91[.]215[.]85[.]42. And then sss.exe, served from both servers. A shared payload is the strongest possible link between two servers. This is the same operator, the same infrastructure, running a second distribution node.
The server is the dedicated HydraCheat distribution node. HydraCheat is a trojanized gaming cheat tool — a third lure type running alongside the developer interview and software piracy campaigns, targeting gamers specifically.Port 6062 runs an active C2 panel tracking victims through ID-based URLs:
http://2.27.28.167:6062/?id=x-mngs8eyo-o2c
http://2.27.28.167:6062/?id=x-mnh2uh25-wpn
Four active download endpoints were confirmed:
One communicating file stood out above everything else — a bundle named byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz with 21/62 detections. Ten malware families packaged into a single file, distributed from a server that also serves gaming cheats to unsuspecting victims.
Dropped files by byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz:
This IP returned an extensive and diverse threat profile far beyond the EtherRAT campaign scope — hosting multiple malware families including RATs, credential stealers, and banking trojans targeting major financial institutions. The ChromeElevator tag indicates active abuse of Chrome's elevation service for privilege escalation, suggesting this IP serves as a multipurpose malicious hosting node potentially shared across several threat actors and campaigns.
Taking a closer look at a few of these infostealers:
83[.]217[.]208[.]72 — Secondary HydraX Panel
Svchost.exe, one of the key files on 91[.]215[.]85[.]42, contacted 83[.]217[.]208[.]72 directly. Same ASN as 2[.]27[.]28[.]167 — AS205775 Neon Core Network LLC, Partner Hosting LTD, Frankfurt. Same port 6062 panel. Same HydraCheat lures. Same trojanized software titles.
The port 6062 victim tracking pattern is identical across both servers, confirming the same panel software running on both:
http://83.217.208.72:6062/?id=x-mmjrrzv2-i7x
http://83.217.208.72:6062/?id=s-mn0zb6u0-llh
http://83.217.208.72:6062/?id=x-mm2dwy8j-jv4
http://83.217.208.72:6062/?id=x-mkln4v78-qj8
External threat intelligence links this IP to SoshiVNC RAT and HexReaper/Kortex RAT campaigns — remote access tooling operating on the same infrastructure alongside the stealer and botnet components.The domain trusteepius-airdrop[.]club was found communicating with this server on ports 8000, 8001 and 889 — a crypto airdrop impersonation domain, adding a fourth social engineering angle to the operation targeting cryptocurrency users.
83[.]217[.]208[.]93 — Exfiltration Server
Notably, the presence of Vidar Stealer on this IP draws a compelling connection back to Lazarus Group — the same threat actor attributed throughout this investigation — further reinforcing the potential infrastructure overlap across this campaign.
While 83[.]217[.]208[.]72 distributes payloads, 83[.]217[.]208[.]93 collects what they steal. Same ASN, same city, different purpose.
Port 5021 runs a dedicated exfiltration endpoint collecting stolen data from victims across the entire cluster:
http://83.217.208.93:5021/getlog/x/08oFdi40aT0t
http://83.217.208.93:5021/getlog/m/08oFdi40aT0t
http://83.217.208.93:5021/getlog/s/ku28uvxnzx62uc7o0
The /getlog/ path is unambiguous — victim logs being uploaded in real time. The path variables x, m and s likely categorize different data types being exfiltrated. Malware families confirmed uploading to these endpoints include midie, CryptBot and Stealer, with activity recorded from March through May 2026.The server also served ss.exe and s.exe directly as download samples, confirmed as passwordstealer family — the same Observer stealer we traced through the entire chain.
144[.]31[.]238[.]173 — HydraX Brand Infrastructure
We reached 144[.]31[.]238[.]173 through the node binary's contacted URLs, which called http://144[.]31[.]238[.]173:8080/files/52.exe directly alongside its calls to 91[.]215[.]85[.]42. When we looked it up, the passive DNS immediately gave us what we needed.
The domain hydrax[.]lol resolved to this IP — the HydraCheat brand's actual domain, tying the entire gaming lure campaign back to a named criminal infrastructure. HydraX is not just a trojanized cheat tool distributed opportunistically. It is a branded operation with its own domain and dedicated hosting.The communicating files confirmed the connection — HydraCheat8.8.3.msi and a trojanized node binary, both files we had already seen across the cluster.
The server served two active payloads from port 8080:
AlienBot is a banking trojan targeting financial credentials and cryptocurrency wallets. CryptBot is an infostealer specifically focused on cryptocurrency wallet data, browser credentials and saved passwords. Both families align with the financial targeting profile consistent across this entire operation.
The MD5 b8e99d4abee6792cddd3f6f3feaca532 contacted 91[.]215[.]85[.]42:3002, 2[.]27[.]28[.]167 and 144[.]31[.]238[.]173 simultaneously — a single infected machine beaconing to three servers in the cluster at the same time. A sample does not contact three separate servers by coincidence. This is the clearest possible confirmation that all five servers operate as one unified infrastructure under a single operator.
193[.]24[.]123[.]68 — APT Infrastructure Overlap
Among the 55 communicating files on 91[.]215[.]85[.]42, a shell script appeared with a filename that was not a name at all — it was an IP address: 193[.]24[.]123[.]68. A file named after an IP sitting on a bulletproof host is not accidental. We investigated.
What we found went well beyond the EtherRAT campaign.
The IP belongs to AS200593 — Prospero OOO, Moscow, Russia. The same autonomous system as our primary C2 server 91[.]215[.]85[.]42. Two servers, same ASN, one in Saint Petersburg and one in Moscow, both confirmed malicious.
Port 3000 serves a Generic Trojan remote control payload. Port 3011 is flagged at critical level for APT activity. Security reports confirm this IP's active role in exploiting CVE-2025-55182 in React2Shell — the same vulnerability linked to EtherRAT deployment documented in prior industry reporting — and using Ethereum smart contracts for C2 communication. The OSINT tags make the connection explicit: react2shell, dprk, etherrat, ethereum smart contracts, cve202555182.
Beyond EtherRAT, the IP is associated with Sliver C2 framework, XMRig cryptocurrency miner, Kaiji loaders and Cobalt Strike — all delivered as part of sophisticated exploit chains targeting both Russian and international victims from late 2025 through early 2026.
Among the communicating files, trojanized versions of ntdll.dll appeared repeatedly with detections as high as 52/72. ntdll.dll is a core Windows system library responsible for kernel-mode system calls. Replacing it gives an attacker persistent access operating beneath most security tooling.
The download samples and communication logs reveal two active endpoints on this server, both operational well before our investigation began. What makes them significant is not just what they serve, but who they served.
Port 3001 serves two payloads:
The shell script endpoint has been continuously served since at least December 2025, with multiple victims downloading it through May 2026. The deliberately randomized filename is an evasion technique — avoiding meaningful strings to defeat pattern-based detection.
The MD5 d5725519d9e66bc590ac54c11d1d90e5 is the thread that ties everything together. This sample downloaded the shell script from 193[.]24[.]123[.]68:3001. That same MD5 appeared in our 91[.]215[.]85[.]42 request logs hitting http://91[.]215[.]85[.]42:3000/api/reobf/3481534f-07db-4e32-bf0e-df8ba7510211 — the re-obfuscated payload endpoint on our primary EtherRAT C2 server. One infected machine, two servers, the same operation.
Port 3011 serves ccce41b9-e358-4972-b52d-dd1cdbe5f636.msi — a Windows installer delivering Amadey, a loader trojan used to deploy additional payloads including stealers, RATs and ransomware. First seen on this endpoint in October 2025, still active into May 2026.
A Linux shell script on port 3001 and a Windows MSI on port 3011 — cross-platform targeting from the same server. Combined with the shared victim MD5, the explicit etherrat and dprk OSINT tags, and both servers sitting on AS200593 Prospero OOO, 193[.]24[.]123[.]68 is not a separate investigation. It is part of the same one.
IOC Table
Ethereum Addresses
Domains
IP Addresses
File Hashes
URLs / Endpoints
JARM Fingerprint
Malware Families Confirmed
