--- title: "EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks" url: https://daily.dev/posts/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks-outhcsdva source_url: https://webflow.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks type: article source: "Sysdig Blog" published: 2026-05-31T07:44:20.744Z updated: 2026-05-31T09:03:07.361Z tags: ["nodejs", "malware", "ethereum"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 11 min read · 0 upvotes · 0 comments ## Summary Two days after public disclosure of CVE-2025-55182, a maximum-severity RCE vulnerability in React Server Components, the Sysdig Threat Research Team discovered EtherRAT — a sophisticated implant deployed against Next.js applications. Unlike earlier React2Shell payloads (cryptominers, credential stealers), EtherRAT uses Ethereum smart contracts for C2 URL resolution with a consensus mechanism across nine public RPC endpoints, making takedowns nearly impossible. It deploys five independent Linux persistence mechanisms (systemd user service, XDG autostart, cron, .bashrc, and .profile injection), downloads its own Node.js runtime from nodejs.org to avoid detection, and executes arbitrary JavaScript received from the C2 server. On first contact, it sends its own source code to a re-obfuscation endpoint and replaces itself with the response. Attribution overlaps significantly with North Korea's Contagious Interview campaign tooling. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Attackers Use New Tool to Scan for React2Shell Exposure](https://daily.dev/posts/attackers-use-new-tool-to-scan-for-react2shell-exposure-qzj8577e3) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#ethereum](https://daily.dev/tags/ethereum) [View this post on daily.dev](https://daily.dev/posts/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks-outhcsdva)