EtherRAT
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under threat actors.
Search every workspace for EtherRAT. It matches the name as written, so it can find other things that share it.
The items that name it 2
Known Node.js backdoor that resolves its C2 address from the Ethereum blockchain (EtherHiding technique); uses contract address 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831, storage key 0x40b57c3622c1CbfD699207F71F2dE5A8Fe256893; hardcoded build ID ab653feb-9e78-4578-87ed-2e30329fe858; live C2 resolve
All threat actors in this workspace.