EtherRAT pulls its C2 from Ethereum smart contracts, no hardcoded domains
An exposed staging server tied to The Gentlemen ransomware cluster surfaced EtherRAT, a Node.js implant that reads its C2 domains from a public Ethereum smart contract instead of hardcoding them. Since every rotation is permanent on-chain, defenders get the full historical C2 set, here five domains. Operators layered it with Sliver and Go shells for full domain takeover.