EtherRAT Targets Finance and Healthcare via Fake Teams IT Support Calls

The EtherRAT Microsoft Teams attack is a six-stage intrusion chain that exploits employee trust in corporate IT support to bypass technical controls and deliver a blockchain-backed implant.

Stage 1: Email Lure. The target receives a phishing email with a subject line referencing an "Employee Survey" and a malicious PDF attachment. The email content is designed to look like an internal HR communication rather than an external message.

Stage 2: Teams Voice Call. Within minutes of the target opening the PDF, an incoming Teams voice call arrives from an external account configured to display as "System Administrator." Microsoft Teams shows an "External unfamiliar" warning on cross-tenant calls, but most employees trained to trust IT support proceed with the call.

Stage 3: Social Engineering for Remote Access. The caller instructs the victim to install HopToDesk or AnyDesk, legitimate remote desktop tools that are not flagged by endpoint detection as malware. The attacker confirms screen-sharing using Teams' built-in screen control feature, forensically confirmed by the artifact CtrlVirtualCursorWin_000001E8A159B970 in session logs.

Stage 4: MSI Loader Download. With remote access established, the attacker downloads v7.msi (or another version) from camorreado[.]click directly on the victim's machine. This MSI is a custom loader, not EtherRAT itself.

Stage 5: Payload Staging. The MSI drops a Node.js runtime, then decrypts and executes three embedded payloads: stage2_payload1.cmd (loader bootstrapper), stage2_payload2.js (Node.js orchestrator), and stage2_payload3.dat (encrypted EtherRAT core). Two additional stages, stage3_payload1.js and stage4_payload1.js, complete the implant's capability initialization. The final implant writes a persistence registry key at Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup.

Stage 6: Ethereum C2 Resolution. EtherRAT queries a public Ethereum RPC endpoint, reads the live C2 server address stored in smart contract 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f, and begins beaconing. If blockchain resolution fails, EtherRAT falls back to the hardcoded domain necropatia[.]com.

All six stages use legitimate software, standard protocols, or publicly available blockchain infrastructure. No single step, viewed in isolation, unambiguously indicates compromise. Detection requires correlating the entire chain.

Ethereum blockchain C2, also called EtherHiding, is the technique that makes EtherRAT structurally resistant to the takedown methods that disrupt conventional malware infrastructure. Understanding it is essential for evaluating whether your current defenses can stop this campaign.

Standard malware hardcodes C2 server IP addresses or domain names into the binary. Defenders discover those addresses during malware analysis, submit them to threat intelligence feeds, and block them at the firewall or DNS layer. The malware operator must then recompile a new binary with a new address and re-infect victims, which is operationally expensive and exposes new infrastructure.

EtherRAT does not hardcode C2 addresses. Instead, it hardcodes a single Ethereum smart contract address: 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f. A smart contract is a program stored permanently on the Ethereum blockchain. EtherRAT queries a public Ethereum RPC node to read a variable stored in this contract. That variable contains the current C2 server URL. When the operator wants to rotate their C2 infrastructure, they submit a single transaction to update the contract variable. Every infected machine automatically begins connecting to the new address at its next beacon interval.

Blocking this mechanism requires blocking all outbound Ethereum RPC traffic. Public Ethereum nodes are operated by Infura, Alchemy, Cloudflare, and dozens of other providers on standard HTTPS port 443. Blocking Ethereum RPC wholesale disrupts legitimate Web3 applications, security tooling that queries blockchain data, and developer workflows in technology-heavy organizations.

The eSentire research on EtherRAT's SYS_INFO module confirms the C2 retrieval sequence: the implant makes periodic requests to public Ethereum nodes, receives the encoded C2 URL from the contract state, decodes it, and opens a persistent connection. Defender-visible behavioral indicators include periodic outbound HTTPS requests to Ethereum RPC provider domains such as infura.io or cloudflare-eth.com from node.exe processes that have no legitimate business justification on corporate endpoints.

For organizations in financial services and healthcare, the fallback domain necropatia[.]com provides a second detection opportunity. While EtherRAT prefers blockchain resolution, blocking this domain at the DNS and firewall layer forces fallback behavior that may be detectable through timing analysis of beacon intervals.

Unit 42 identifies financial services and healthcare organizations as the sectors currently targeted by the EtherRAT Microsoft Teams campaign. Both sectors share the operational profile that makes this specific attack chain highly effective: large Microsoft 365 deployments, employee familiarity with Teams-based IT support workflows, and high-value data assets that justify the operational overhead of social engineering.

Financial organizations present credential and transaction data as primary targets. EtherRAT's confirmed capabilities include credential harvesting, file exfiltration, and arbitrary command execution. An EtherRAT implant inside a financial organization's endpoint has potential access to banking application credentials, OAuth tokens for financial SaaS platforms, internal RDP and VPN credentials, and file system contents including financial records and client data.

Healthcare organizations face a compound risk. HIPAA-regulated patient data sits alongside the operational systems that directly affect care delivery. An EtherRAT implant with persistent access can exfiltrate electronic health records, harvest credentials to clinical information systems, and serve as the initial access foothold for a follow-on ransomware deployment. Healthcare has remained the top ransomware target sector through the first half of 2026, with 30 confirmed incidents in June alone according to BlackFog's June 2026 State of Ransomware report.

The social engineering mechanism is particularly effective in both sectors because IT help desk impersonation is a known and trusted interaction. Employees at financial institutions and hospitals receive security awareness training about email phishing, but Teams voice calls from apparent IT staff trigger a different cognitive response. Microsoft's own detection research notes that the "External unfamiliar" warning displayed on cross-tenant calls is frequently dismissed by employees who assume the IT support team operates from a different tenant.

The campaign's active development, confirmed by the v1 through v9 installer variants on the distribution server, suggests the operator is iterating toward improved detection evasion. Each version increment likely represents a modification to payload structure, obfuscation method, or loader behavior in response to observed detection.

Unit 42 and GBHackers published the following indicators from the active EtherRAT campaign. Add these to your SIEM detection rules, DNS blocklists, and endpoint hash watchlists immediately. The Ethereum smart contract address and fallback domain are the two most actionable blocking opportunities.

The attacker email helpdesk@Progressive936.onmicrosoft.com confirms the operator registered a Microsoft 365 tenant under the "Progressive936" organization name specifically to conduct Teams calls. Microsoft tenant-level abuse reports submitted against this address will accelerate deactivation. Monitor your Teams admin logs for incoming calls or chat messages from external accounts under onmicrosoft.com domains that do not correspond to known vendor or partner tenants.

The EtherRAT Microsoft Teams campaign maps cleanly to confirmed MITRE ATT&CK techniques. Security teams running detection engineering should prioritize alerting on the T1566.001 and T1598.004 combination as the earliest detectable precursor, and build a second detection layer on T1059.007 (node.exe executing shell commands) as the post-compromise indicator.

T1566.001 — Phishing: Spearphishing Attachment. Initial access via phishing email containing malicious PDF lure.

T1598.004 — Phishing for Information: Social Engineering via Teams. Voice call from external tenant impersonating IT support to social-engineer remote access grant.

T1570 — Lateral Tool Transfer. Delivery of HopToDesk or AnyDesk remote management tools as legitimate cover for attacker access.

T1105 — Ingress Tool Transfer. MSI installer download from camorreado[.]click to victim machine via attacker-controlled remote session.

T1059.007 — Command and Scripting Interpreter: JavaScript. Node.js runtime execution of staged JS payloads as primary implant execution mechanism.

T1547 — Boot or Logon Autostart Execution. Registry key OneDriveSetup under HKCU...\Run ensures EtherRAT restarts on every logon.

T1568.003 — Dynamic Resolution: DNS Calculation. Ethereum smart contract used as blockchain dead-drop resolver to evade static C2 blocking.

T1071.001 — Application Layer Protocol: Web Protocols. Beaconing over HTTPS to Ethereum RPC endpoints and C2 server, blending with legitimate web traffic.

The combination of T1568.003 with the Teams social engineering chain (T1598.004) is the technique pairing that distinguishes this campaign from conventional phishing. Neither technique alone indicates EtherRAT; both together in the same event timeline, with a node.exe process spawn shortly after, constitute a high-confidence detection signal.

For comparison, the DragonForce ransomware campaign used Teams as a covert C2 channel post-compromise, embedding ransomware command traffic inside Teams messages. EtherRAT uses Teams only for initial social engineering — the actual C2 runs through the Ethereum blockchain and HTTPS. Both campaigns demonstrate that Microsoft Teams is now a primary attack surface for corporate intrusion chains.

The EtherRAT Microsoft Teams attack chain has seven controllable intervention points. Steps 1 through 3 address the social engineering entry point. Steps 4 through 6 address post-delivery detection and blocking. Step 7 addresses the persistence mechanism for organizations that have already been compromised.

The EtherRAT Microsoft Teams attack succeeds because it weaponizes two things that enterprise security programs actively cultivate: employee trust in IT support interactions and legitimate collaboration tooling. Security awareness training teaches employees to report unsolicited emails. It does not train them to distrust voice calls from people who already have their name, know they just opened an IT document, and are calling from what appears to be an internal IT support account on the corporate communication platform.

Microsoft's cross-tenant "External unfamiliar" warning exists precisely to flag this attack vector, but its presence in the UI creates a false sense that the defense is the user's responsibility. The warning fires on every external call, including legitimate vendor calls and partner support lines. In organizations where external Teams calls from consultants, managed service providers, and SaaS vendors are routine, the warning has become ambient noise. Attackers understand this and design their lures to normalize the call in the first 30 seconds before the victim considers the external origin label.

The Ethereum blockchain C2 mechanism represents a deliberate arms race escalation. Conventional incident response playbooks treat C2 infrastructure takedown as a follow-on step after detection. EtherRAT makes that step structurally difficult: the smart contract address is permanent and stored across thousands of distributed Ethereum nodes. Law enforcement can request that hosting providers take down domains. There is no equivalent legal mechanism to force the Ethereum network to invalidate a smart contract. The operator retains full C2 capability as long as any Ethereum node is accessible from the victim network.

This campaign's connection to previous EtherRAT activity, including the ConsentFix OAuth campaign targeting Microsoft 365, reflects a broader pattern: sophisticated operators are building layered attack chains specifically against Microsoft 365 tenants, treating the Teams platform, the OAuth consent framework, and the identity layer as a unified attack surface rather than isolated products. Organizations running Microsoft 365 should treat Teams external access restrictions as a security control, not just a productivity configuration.

The 9 installer versions confirmed by Unit 42 indicate the operator is actively iterating to evade detection. Endpoint security platforms that caught v1 through v5 may not flag v7 or v9. Behavioral detection on the node.exe execution chain, the Ethereum RPC beaconing pattern, and the Teams external call correlation is more durable than hash-based detection for this threat.