--- title: "EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2" url: https://daily.dev/posts/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2-7aajfhljh source_url: https://webflow.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2 type: article source: "Sysdig Blog" published: 2026-05-31T07:43:51.422Z updated: 2026-05-31T08:17:33.218Z tags: ["malware", "nextjs"] reading_time: 16 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2 **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 16 min read · 0 upvotes · 0 comments ## Summary Sysdig's Threat Research Team dissects EtherRAT, a novel implant exploiting CVE-2025-55182 (React2Shell RCE in React Server Components) against Next.js applications. The malware uses an Ethereum smart contract for resilient C2 resolution, querying nine public RPC endpoints for consensus. Five post-compromise payloads are analyzed: system reconnaissance with CIS country exclusion, credential and crypto wallet harvesting using embedded BIP39 wordlists and 50+ regex patterns, a self-propagating worm that scans for vulnerable Next.js servers including private IP ranges, an nginx/Apache web server hijacker redirecting traffic to xss.pro, and an SSH backdoor via authorized_keys injection. All payloads run fileless via Node.js. The blockchain C2 creates an immutable forensic record, revealing the attacker's wallet, C2 URL history, and a brief Grabify link used for victim enumeration. Attribution is complicated by CIS exclusion patterns (typical of Russian-speaking actors) conflicting with DPRK-linked TTPs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation](https://daily.dev/posts/react2shell-exploitation-escalates-into-large-scale-global-attacks-forcing-emergency-mitigation-2fekecp9t) · The Hacker News · 33 upvotes · 3 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#nextjs](https://daily.dev/tags/nextjs) [View this post on daily.dev](https://daily.dev/posts/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2-7aajfhljh)