Sysdig's Threat Research Team dissects EtherRAT, a novel implant exploiting CVE-2025-55182 (React2Shell RCE in React Server Components) against Next.js applications. The malware uses an Ethereum smart contract for resilient C2 resolution, querying nine public RPC endpoints for consensus. Five post-compromise payloads are analyzed: system reconnaissance with CIS country exclusion, credential and crypto wallet harvesting using embedded BIP39 wordlists and 50+ regex patterns, a self-propagating worm that scans for vulnerable Next.js servers including private IP ranges, an nginx/Apache web server hijacker redirecting traffic to xss.pro, and an SSH backdoor via authorized_keys injection. All payloads run fileless via Node.js. The blockchain C2 creates an immutable forensic record, revealing the attacker's wallet, C2 URL history, and a brief Grabify link used for victim enumeration. Attribution is complicated by CIS exclusion patterns (typical of Russian-speaking actors) conflicting with DPRK-linked TTPs.
