Gentlemen Ransomware Affiliate Leverages Ethereum Smart Contracts for Stealthy C2 Operations A Gentlemen ransomware affiliate has adopted a novel tactic to evade detection, using Ethereum smart contracts to dynamically resolve command-and-control (C2) domains via the EtherRAT backdoor. Unlike traditional malware that hardcodes C2 infrastructure, this campaign queries public Ethereum RPC endpoints including Tenderly, Flashbots, MEVBlocker, and PublicNode to fetch rotating domains from an on-chain contract, ensuring resilience against takedowns. The attack chain begins with MSI payloads (cons_c1.0.1.msi, cons_1.0.1.msi) deployed via remote scheduled tasks. Once executed, EtherRAT a Node.js-based trojan decrypts an XOR-encoded backdoor, establishes persistence via a Run key ("WindowsHost"), and launches in headless mode through conhost.exe. The malware avoids fixed infrastructure by embedding a smart contract lookup key, resolving C2 domains such as publisherresolution[.]com, resumeacceptable[.]com, and wiselystarting[.]com, mirroring tactics seen in prior EtherHiding supply-chain attacks. Post-exploitation tools include LSASS and registry-hive dumping, ESET service tampering, and reverse shells (Sliver, Go-based binaries) for lateral movement. Operators use SOCKS proxies (Chisel, Ligolo-ng) and UUID-based bot tracking to maintain persistence across sessions. Beacon traffic mimics benign static asset requests (e.g., png, css, ico) with randomized paths, while a custom "X-Bot-Server" header identifies resolved controllers an indicator previously linked to DPRK-adjacent campaigns. An exposed open directory (193.233.202[.]17) revealed 82 artifacts (145 MB) reconstructing the full intrusion, including PowerShell bootstraps, a privileged account (support2:Supp0rt2@2026!), and multi-stage payloads (pb39_new.exe, update.exe). The infrastructure spans AS203273 (NetCrafters OU, Estonia) and AS174 (Cogent Communications, US), with historical ties to AEZA ASN ranges. Additional C2s (38.110.228[.]43, 38.110.228[.]125) align with a Gambit Security-documented Gentlemen ransomware case, reinforcing the link between blockchain-anchored C2 and this ransomware ecosystem. The use of on-chain domain rotation provides attackers with takedown-resistant agility, while defenders gain a permanent ledger of historical C2s a double-edged sword for attribution and mitigation.