Two days after public disclosure of CVE-2025-55182, a maximum-severity RCE vulnerability in React Server Components, the Sysdig Threat Research Team discovered EtherRAT — a sophisticated implant deployed against Next.js applications. Unlike earlier React2Shell payloads (cryptominers, credential stealers), EtherRAT uses Ethereum smart contracts for C2 URL resolution with a consensus mechanism across nine public RPC endpoints, making takedowns nearly impossible. It deploys five independent Linux persistence mechanisms (systemd user service, XDG autostart, cron, .bashrc, and .profile injection), downloads its own Node.js runtime from nodejs.org to avoid detection, and executes arbitrary JavaScript received from the C2 server. On first contact, it sends its own source code to a re-obfuscation endpoint and replaces itself with the response. Attribution overlaps significantly with North Korea's Contagious Interview campaign tooling.
