EtherRAT Malware Hijacks Ethereum Blockchain for Covert C2 After React2Shell Exploit

In the security online report, EtherRAT is described as a persistent malware strain that hijacks the Ethereum blockchain to receive its commands, a C2 mechanism branded as EtherHiding. Sysdig Threat Research Team reportedly found the implant 48 hours after the public disclosure of the React2Shell vulnerability and on December 5, 2025 noted that it was uncovered in a compromised Next.js application.

The researchers say EtherRAT uses Ethereum smart contracts for C2 resolution, disguising traffic as legitimate blockchain interactions to complicate takedown efforts. The analysis also notes striking similarities between EtherRAT and North Korea-linked tooling, with claims that Lazarus Group or its affiliates (tracked as UNC5342) may have pivoted to exploit the React2Shell flaw or shared advanced tooling.

EtherRAT is described as highly persistent, deploying five independent Linux persistence mechanisms, and it even downloads its own Node.js runtime from nodejs[.]org to blend in with trusted software processes. The report frames this development as a shift from opportunistic attacks to an advanced persistent threat vector targeting the React2Shell exposure.