EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks | Sysdig

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Used to gain initial unauthenticated RCE via the React Server Components vulnerability CVE-2025-55182 (‘an unsafe deserialization vulnerability in RSCs that allows unauthenticated remote code execution via a single HTTP request.’)
• [T1059.004 ] Unix Shell – Shell commands used to decode and execute a base64 dropper and run a persistent download loop (‘sh -c echo |base64 -d|bash’ and the subsequent while loop downloading s.sh)
• [T1105 ] Ingress Tool Transfer – Downloading runtime and payloads from external sources (staging server and nodejs.org) to the victim (‘# Download Node.js runtime from official source’ and curl/wget to nodejs.org)
• [T1059.007 ] JavaScript – Executing operator-provided JavaScript via the AsyncFunction constructor to run arbitrary Node.js code (‘const a0 = Object.getPrototypeOf(async function () {}).constructor;’ and ‘treats it as JavaScript code and executes it immediately’)
• [T1071.004 ] Application Layer Protocol: Web Services – C2 resolution and communication via public Ethereum RPC endpoints and HTTP(S) requests to the resolved C2 (‘EtherRAT queries all nine endpoints in parallel’ and uses HTTP GET/POST to C2 URLs)
• [T1027 ] Obfuscated Files or Information – Use of encrypted blobs, hardcoded AES-256-CBC keys/IV, base64-encoded payloads, and obfuscated JS dropper (‘AES-256-CBC decryption’ and base64_encrypted_blob / base64_obfuscated_js)
• [T1547 ] Boot or Logon Autostart Execution – Multiple persistence mechanisms to achieve execution on boot/login including systemd user services, XDG autostart, cron @reboot, and shell profile modifications (‘Systemd user service’, ‘XDG autostart entry’, ‘Cron job’, ‘Bashrc/profile modifications’)
• [T1560 ] Archive Collected Data / T1106 ] Native API? (represented as self-modifying/update behavior) – Self-update/re-obfuscation mechanism where the implant posts its source to /api/reobf/ and replaces itself with the response (‘s + “/api/reobf/”‘ and ‘n.writeFileSync(N, R, “utf8”); n.spawn fresh process’)