Gentlemen Ransomware Affiliate Deploys EtherRAT via Remote Scheduled Tasks
Attackers linked to the Gentlemen ransomware operation are distributing EtherRAT malware across Windows domains using remote scheduled tasks, leveraging administrative shares and WMI for widespread compromise.
A sophisticated campaign attributed to an affiliate of the Gentlemen ransomware operation has been observed deploying the EtherRAT malware across compromised Windows domains. This attack highlights a common yet potent tactic: leveraging a single initial foothold to achieve widespread network compromise through the abuse of administrative privileges and built-in Windows functionalities.
The attackers utilized remote scheduled tasks as a primary mechanism for distributing malicious installer packages to other systems within the domain. These installers, in turn, deployed EtherRAT, a versatile remote access tool built on Node.js. EtherRAT is capable of stealing credentials, establishing persistent access, and is designed to make its command-and-control (C2) infrastructure difficult to track, notably by utilizing Ethereum smart contracts.
Security researchers from Hunt.io uncovered evidence of this campaign after identifying an exposed directory on a compromised server. This directory contained a comprehensive toolkit, including scripts, task configurations, installers, tunneling tools, and reverse shells. The presence of these diverse tools suggests a deliberate effort by the attackers to maintain multiple backdoors into the victim environment while simultaneously exfiltrating credentials and Active Directory data.
The distribution method involved exploiting administrative shares and Windows Management Instrumentation (WMI) to reach internal hosts. Malicious scripts copied payloads to remote machines and then created scheduled tasks with seemingly innocuous names like 'WinSvcUpdate2' and 'WindowsUpdSvc' to blend in with legitimate system activities. This underscores how the Windows Task Scheduler can be abused not only for persistence but also as a powerful delivery vector for lateral movement.
One particularly concerning aspect of the attack involved a scheduled task executed under the SYSTEM account. This task downloaded a PowerShell script that attempted to create a local administrator account, add it to the Domain Admins group, disable security services, export registry hives, and establish a tunnel for remote access. The script also staged reverse-shell tooling, providing the operators with backup access routes should their primary methods fail.
EtherRAT's deployment is further obfuscated by the use of legitimate Windows utilities like certutil.exe to download MSI packages, which are then installed silently via msiexec.exe. A fallback mechanism also copied the installer through SMB. This blend of legitimate tools and administrative access can be difficult to detect without diligent monitoring of task creation events, remote share writes, and unusual process executions originating from the task scheduler.
Upon installation, EtherRAT establishes persistence by creating a Run-key entry and decrypting a JavaScript backdoor. Its C2 communication is particularly noteworthy: instead of relying on a fixed IP address or domain, it queries an Ethereum smart contract to dynamically obtain the current C2 server address. This allows attackers to change their C2 infrastructure without updating the malware itself, while investigators can analyze the smart contract's history to trace past C2 domains.
Security teams are urged to urgently review scheduled tasks, especially those running as the SYSTEM account or executing PowerShell scripts. Monitoring for unusual remote share activity, unexpected processes, newly created privileged accounts, and outbound traffic to public Ethereum RPC services are critical steps in detecting and mitigating this threat. Isolating affected systems, resetting compromised credentials, and checking for persistence mechanisms are vital containment measures.