EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades

EtherRAT is a sophisticated malware campaign targeting enterprise administrators and DevOps engineers through impersonated administrative tools distributed via GitHub facades.

• •SEO poisoning across multiple search engines ranks malicious GitHub facades at the top of search results for IT administrative tools.
• •A dual-stage GitHub architecture separates SEO-optimized facade repositories from malware delivery, enabling rapid rotation while maintaining search rankings.
• •The malware impersonates 44 different Windows administrative tools including PsExec, AzCopy, Sysmon, LAPS, and Kusto Explorer to compromise high-privilege accounts.
• •Ethereum smart contracts provide decentralized command-and-control resolution through public RPC endpoints, making traditional infrastructure takedowns ineffective.

This summary was automatically generated by AI based on the original article and may not be fully accurate.