---
id: 6169
title: "The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2"
source_domain: hunt.io
source_url: "https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2"
published_at: "2026-08-04T00:00:00Z"
tags: ["web3", "threat-intelligence", "ransomware", "c2", "smart-contract", "backdoor", "ethereum"]
phying_url: "https://phying.com/item/6169"
lang: en
---

# The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

## Summary

An exposed open directory tied to The Gentlemen ransomware revealed EtherRAT, a Node.js backdoor that resolves rotating C2 domains from an Ethereum smart contract, plus Sliver tunnels.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-08-04T00:00:00Z
- **Original:** https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2
- **Phying News:** https://phying.com/item/6169