North Korea-linked actors have exploited a critical flaw in widely used web applications by deploying new blockchain-based malware that represents a “significant evolution” in cybercriminal techniques, according to cybersecurity researchers.

The new remote access trojan (RAT), dubbed EtherRAT, enables intruders to quietly take long-term control of compromised servers, update malicious code on the fly and evade many traditional security defenses, cloud security firm Sysdig said in a report published Monday.

Its deployment hinges on CVE-2025-55182, a “maximum-severity” vulnerability disclosed on Dec. 3 that allows any internet user to run remote commands on vulnerable server components