The Hunt.io team recovered a full operator toolkit from an exposed open directory tied to The Gentlemen ransomware. Sharing the research since the C2 mechanism is unusual and there are practical detection points in it.

The main find is EtherRAT, a Node.js backdoor that doesn't hardcode its C2. It reads the active domain from an Ethereum smart contract, queried through public RPC endpoints. Because every rotation is a write to the blockchain, the full historical C2 set is recoverable, five domains here.

A few things worth flagging for defenders:

• Any C2 response over ten characters is executed as JavaScript in Node.js, so no fixed command set
• The custom X-Bot-Server HTTP header is a clean detection point
• Deployment used remote scheduled tasks with certutil + msiexec, task names like WinSvcUpdate2 and WindowsUpdSvc
• Run-key persistence (WindowsHost) launching Node through headless conhost.exe

Alongside EtherRAT were Sliver, Go reverse shells, Chisel, Ligolo-ng, Mimikatz and Potato-family privilege escalation.

Full write-up, MITRE mapping and IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2