EtherRAT has been identified as the payload in a new wave of attacks where remote scheduled tasks are used to distribute malware across Windows domains. This approach, linked to affiliates of the Gentlemen ransomware operation, demonstrates how attackers can quickly escalate a single system compromise to a domain-wide threat using built-in Windows features. The use of remote scheduled tasks to push EtherRAT, a Node.js-based remote access tool, is a stark reminder of how adversaries exploit automation and privilege to establish persistence, steal credentials and maintain control within enterprise environments.
Attack Overview: Remote Scheduled Tasks in Windows Domain Intrusions
The campaign was first observed when attackers gained an initial foothold within a Windows domain. Using elevated privileges, they leveraged the Windows Task Scheduler to create remote scheduled tasks. These tasks were designed to execute malicious installer packages on targeted endpoints across the network. The installer, once executed, deployed EtherRAT, granting attackers remote access and control over infected systems.
This technique is particularly concerning because Windows Task Scheduler is a legitimate administrative tool. When abused, it allows adversaries to move laterally with minimal detection by endpoint security solutions that often rely on signature-based detection or focus on executable files rather than scheduled task creation and management.
- Initial access: Attackers exploit a vulnerable endpoint or use stolen credentials to enter the Windows domain.
- Privilege escalation: They obtain administrative rights, enabling creation of scheduled tasks remotely.
- Propagation: Malicious scheduled tasks are deployed, instructing systems to download and execute EtherRAT installers.
- Persistence: EtherRAT establishes ongoing access, executes commands, and harvests credentials from compromised systems.
How EtherRAT Operates: Features and Impact
EtherRAT is a remote access tool built on Node.js, making it cross-platform and adaptable. Its modular design enables attackers to maintain persistence, execute arbitrary commands, and steal sensitive data, including credentials. Once resident on a system, EtherRAT communicates with a command and control (C2) server to receive instructions and exfiltrate data.
Key capabilities of EtherRAT include:
- Command execution: Attackers can run system commands or scripts on infected machines.
- Credential theft: The malware targets stored passwords and authentication tokens.
- Persistence mechanisms: EtherRAT can survive reboots and user logouts using scheduled tasks or registry modifications.
- Data exfiltration: Files and sensitive information are sent to remote servers under attacker control.
Recent research indicates that EtherRAT infrastructure is often concealed using blockchain-based hiding techniques, complicating detection and takedown efforts. This additional layer of obfuscation makes it more difficult for defenders to identify and block C2 communications.
Timeline and Exploitation Status
The EtherRAT propagation campaign tied to the Gentlemen ransomware group has been active in 2024, with incidents reported from late spring through early summer. Detailed forensic analysis shows the following progression:
- Initial compromise: June 2024 – A Windows endpoint is breached via phishing or credential theft.
- Domain escalation: Within hours, attackers use administrative rights to push scheduled tasks to multiple systems.
- EtherRAT deployment: Malicious installers are executed automatically, infecting dozens of systems in minutes.
- Detection: Security teams observe anomalous task creation and outbound connections to suspicious domains.
The campaign remains active, with security researchers warning that the use of legitimate tools like Task Scheduler may allow similar threats to evade some traditional security controls. Organisations running Windows domains, especially those with open lateral movement paths and weak privilege management, are at heightened risk.
Why This Matters: Single Foothold, Network-Wide Risk
The EtherRAT incident shows how a single compromised endpoint, if not quickly contained, can result in rapid and stealthy malware propagation across an entire Windows domain. The abuse of remote scheduled tasks exemplifies how attackers weaponise legitimate administrative tools, turning trusted infrastructure against defenders. With EtherRAT’s credential theft capabilities, attackers can further deepen their access and potentially escalate to ransomware deployment or data theft at scale.
What Organisations Should Do Now
Organisations should review use of scheduled tasks within their Windows environments and monitor for unusual remote task creation, particularly by accounts with elevated privileges. Network segmentation and least privilege access can limit the blast radius of these attacks. Rapid detection and response to anomalous task scheduling is key to preventing lateral movement and widespread compromise.
Originally reported by cybersecuritynews.com.
