EtherRAT distribution spoofing administrative tools via GitHub Facades

Introduction

A sophisticated, high-resilience malicious campaign was identified by Atos Threat Research Center (TRC) in March 2026. This operation specifically targets the high-privilege professional accounts of enterprise administrators, DevOps engineers and security analysts by impersonating administrative utilities they rely on for daily operations. By integrating Search Engine Order (SEO) poisoning, a dual-stage GitHub distribution architecture and decentralized blockchain based command-and-control (C2) resolving, Threat Actors have established a highly resilient delivery and persistence mechanism.