EtherRAT

Multiple threat actors have revived the abuse of Node.js to evade detection by executing malicious JavaScript payloads through the legitimate, signed node.exe runtime. The attacks, observed since February 2026, targeted government departments, technology companies, and hotels. In one campaign, attackers used a ClickFix-style lure to deploy PowerShell scripts, established persistence, and leveraged Node.js to connect to Ethereum blockchain gateways (EtherHiding) for command retrieval. A related intrusion involved the deployment of a Rust-based backdoor, C2Looper, linked to ransomware operations. The same actors used shared infrastructure, including the C2 domain datalayerservice[.]com and IP 45.158.196[.]23:8888, across multiple victims.

A Chinese-speaking threat actor is leveraging AI models like Anthropic Claude, Alibaba Qwen, and DeepSeek to automate cyber intrusions against government and financial systems in multiple countries, including Taiwan, Afghanistan, Thailand, and the U.S. The campaign uses an AI orchestration framework called SecFlow to divide tasks among specialized AI agents for reconnaissance, exploitation, and data collection. Exploited vulnerabilities include Log4Shell, Spring4Shell, and Shiro deserialization, leading to web shell deployment and lateral movement using a Go-based backdoor named SecBox. The campaign was first reported in July 2026. Another related campaign involves EtherRAT and TukTuk malware, where attackers deploy ransomware known as The Gentlemen after gaining access via malicious MSI installers and conducting credential theft and lateral movement.

Threat actors are leveraging the legitimate Node.js runtime (node.exe) to deliver malware in targeted attacks against government departments, technology firms, and hotels since February 2026. By using signed, trusted binaries and executing malicious JavaScript scripts, attackers evade signature-based detection. The attacks involve tools such as AdaptixC2, Cobalt Strike, ModeloRAT, Mistic (MLTBackdoor), GateKeeper, and C2Looper, with initial access often gained via the ClickFix social engineering technique. Attackers also abuse EtherHiding and blockchain-based C2 infrastructure for resilience, making blocking efforts difficult.

Multiple active threat campaigns were reported, including a new SideWinder attack chain using ClickOnce files to deploy Rust-based backdoors, a large-scale npm supply chain attack named 'Flooding Dropper' involving 846 malicious packages, and a Chinese threat actor leveraging a DeepSeek AI agent in an LLM-managed campaign for proxyjacking. A new XCSSET macOS malware variant (v40) spreads via compromised Xcode projects and includes a Telegram trojanizer. The Gentlemen ransomware affiliate deployed EtherRAT, which retrieves C2 data from an Ethereum smart contract. Additionally, Interlock ransomware abused Volatility3 to extract credentials from memory, and a critical RCE flaw in the Odysseus AI workspace allowed authenticated users to execute OS commands. Several phishing campaigns used fake Bank of America and Coldcard wallet lures to install ScreenConnect, while AI-powered scam farms like FunFoneFarm lower the barrier to entry for cybercrime.

This week's threat landscape highlights a range of cyber activities, from cloud bucket hijacking and ransomware tooling overlaps to social engineering campaigns and supply chain attacks. Notable incidents include a global fraud operation resulting in nearly 6,000 arrests, typosquatting of payment SDKs on npm and PyPI, and the abuse of Microsoft Teams for delivering EtherRAT. Additionally, new techniques like Process Parameter Poisoning and ADFS token forgery underscore evolving evasion and privilege escalation methods.

Threat actors are conducting fake IT support calls via Microsoft Teams to trick employees into installing the EtherRAT malware. The attack begins with a phishing email containing a malicious PDF, followed by a voice call from an external Teams account impersonating system administrators. Attackers use legitimate remote access tools like HopToDesk and AnyDesk, then deploy EtherRAT via a malicious MSI installer, enabling full system control and data theft. EtherRAT uses Ethereum smart contracts for C2 resilience, and the campaign is actively evolving with multiple malware versions observed.