Unit 42 Details Teams IT-Impersonation Campaign Deploying EtherRAT
Summary
Unit 42 reports a campaign using phishing and impersonated Microsoft Teams IT calls to install EtherRAT through remote-access tools and a malicious MSI. EtherRAT uses Ethereum smart contracts for C2; Microsoft has added external-caller warnings and bot lobby controls.
Key points
- Unit 42 says the campaign starts with an “Employee Survey” phishing email and malicious PDF, followed by a Teams call from someone posing as a system administrator.
- Callers persuade victims to grant remote control and install HopToDesk or AnyDesk.
- A malicious MSI downloaded from camorreado[.]click installs Node.js and launches EtherRAT.
- The Node.js-based RAT can execute commands, manipulate files, steal data and persist; it uses Ethereum smart contracts to retrieve its C2 server.
- Unit 42 found an open distribution directory containing installer versions v1 through v9, which it says indicates ongoing development.
- The article says EtherRAT was previously used in state-sponsored attacks exploiting React2Shell and has since been adopted by other threat actors.
- Microsoft has added warnings for external Teams callers and chats and a policy that holds suspected third-party bots in the meeting lobby for approval.
Article Details
- Event Type
- Phishing and Microsoft Teams vishing campaign delivering EtherRAT malware
- Impact
- Attackers reportedly impersonate IT support, persuade employees to grant remote control and install remote-access software, then use a malicious MSI to deploy EtherRAT and gain access to compromised systems. EtherRAT can execute commands, manipulate files, steal data, maintain persistence, and retrieve its C2 server through Ethereum smart contracts; the article does not confirm specific data theft in this campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | camorreado[.]click | Domain from which the campaign's malicious MSI installer was downloaded. |
helpdesk@progressive936[.]onmicrosoft[.]com | External account used by the attacker to initiate a Teams chat while impersonating IT support. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe malicious MSI downloaded a Node.js runtime and launched the EtherRAT payload.T1204.002 · Malicious FileVictims opened the phishing email's malicious PDF and were persuaded to install the malware-delivery MSI.T1219 · Remote Access ToolsAfter persuading victims to grant remote control, attackers guided them to install HopToDesk or AnyDesk for remote access.T1566.001 · Spearphishing AttachmentThe campaign began with a phishing email containing an “Employee Survey” lure and malicious PDF attachment.
Malware
Vendors
Products
AnyDeskAttackers persuade users to enable remote control and install HopToDesk or AnyDesk.HopToDeskAttackers persuade users to enable remote control and install HopToDesk or AnyDesk.Microsoft TeamsThreat actors are abusing Microsoft Teams voice calls and phishing emails to impersonate IT support staff and trick employees into installing EtherRAT malware.Node.jsThe campaign uses legitimate remote tools, a Node.js-based loader, and Ethereum smart contracts for command-and-control, while also highlighting Microsoft’s added protections against these Teams abuse tactics.