EtherRAT Malware Hijacks Ethereum Smart Contracts for Stealth Command-and-Control Operations

Security researchers have uncovered a sophisticated new malware strain that uses Ethereum smart contracts as a command-and-control infrastructure, marking a significant evolution in how state-sponsored threat actors abuse blockchain technology for cyberespionage. The discovery of EtherRAT, documented by the Sysdig Threat Research Team on December 15, 2025, exposes a troubling convergence of cryptocurrency infrastructure and advanced persistent threats.

The Exploit Mechanics

EtherRAT enters targeted systems through CVE-2025-55182, a critical vulnerability dubbed React2Shell that affects React Server Components in React 19.x and Next.js versions 15.x and 16.x. The flaw enables unauthenticated remote code execution through a single HTTP request by exploiting unsafe deserialization in React Server Components. The vulnerability was disclosed on December 3, 2025, and was quickly added to CISA’s Known Exploited Vulnerabilities catalog as active exploitation surged across the internet.

Once inside a compromised application, EtherRAT deploys a persistent espionage tool rather than the typical cryptocurrency miners seen in earlier opportunistic attacks. The malware establishes its command-and-control channel through a technique researchers call EtherHiding, querying a specific Ethereum smart contract to retrieve its command server URL.

Affected Systems

The attack chain primarily targets web applications built with Next.js using the App Router pattern. React 19.x applications running on Next.js 15.x and 16.x are directly vulnerable. The impact extends beyond the compromised servers themselves, as the malware’s C2 traffic masquerades as legitimate HTTPS requests to well-known blockchain RPC endpoints including Cloudflare, Flashbots, and PublicNode.

To ensure the integrity of its C2 channel, EtherRAT queries nine distinct public RPC endpoints simultaneously and only accepts the server URL returned by the majority consensus. This makes traditional IP-based blocking completely ineffective against the malware’s communication infrastructure.

The Mitigation Strategy

Organizations running React 19.x or Next.js 15.x and 16.x applications must immediately apply the security patches released by the React and Next.js teams. The vulnerability carries maximum severity classification, meaning that unpatched systems are essentially open doors for remote code execution with no authentication required.

Beyond patching, defenders should monitor outbound traffic to public Ethereum RPC endpoints from non-blockchain application servers. Network security teams can implement behavioral analysis rules to detect the consensus-based C2 pattern, where a single process queries multiple RPC endpoints simultaneously.

Lessons Learned

The EtherRAT campaign demonstrates that blockchain infrastructure is no longer just a target for attackers — it has become an active tool in their arsenal. By leveraging Ethereum smart contracts for C2, the malware operators have created a resilient, censorship-resistant communication channel that is nearly impossible to take down without disrupting legitimate blockchain traffic.

The attack also highlights the growing sophistication of North Korean state-sponsored groups. Unlike the simple cryptocurrency mining operations typically associated with DPRK cyber units, EtherRAT focuses on long-term stealth and persistent espionage. Significant code overlaps between EtherRAT and the Contagious Interview campaign suggest the same threat group is evolving its tradecraft.

User Action Required

Developers and system administrators should take immediate action: update all React and Next.js installations to the latest patched versions, audit web application logs for unusual outbound connections to Ethereum RPC endpoints, and deploy runtime application self-protection tools that can detect deserialization attacks in real time. Organizations using Bitcoin at approximately $86,420 or Ethereum at $2,964 should also verify that their crypto-related infrastructure has not been compromised by this supply chain attack vector.

Disclaimer: This article is for informational purposes only and does not constitute cybersecurity advice. Always consult with qualified security professionals for specific threat mitigation strategies.