“React2Shell” Exploited: New EtherRAT Malware Hunts for Crypto via Node.js

According to ASEC researchers, a new malware campaign is exploiting a recently disclosed vulnerability to install cryptocurrency-stealing software on servers, using a multi-stage EtherRAT that leverages the React2Shell flaw. The attack uses legitimate runtime environments, specifically Node.js, to mask activity and turn compromised servers into zombies that query the Ethereum blockchain.

It begins with a probe on port 80, and successful breaches lead to the installation of EtherRAT, which then attempts to steal information and cryptocurrency. The malware downloads and runs a legitimate Node.js version (v20.10.0) to execute its scripts, and it targets a hardcoded contract address (0x22f96d61cf118efabc7c5bf3384734fad2f6ead4) via JSON-RPC calls to public endpoints such as Flashbots, LlamaRPC, and Ankr.

Administrators are urged to monitor for unauthorized Node.js processes and unusual HTTPS traffic to known Ethereum RPC URLs, as the campaign aims to exploit a broad, indiscriminate net rather than high-value targets.