microsoft-tools.com
microsoft-tools.com is a domain
that 2 published sources report
in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Sysdig.
The reports are dated 2026-10-03.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-02-03 | 2026-02-03 |
0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610 |
Etherscan | Wallet, ethereum | owner wallet | EtherRAT | 2026-02-03 | 2026-02-03 |
domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED
Registration
| Registered | 2026-02-03 |
|---|---|
| Registrar | Key-Systems GmbH |
| Expires | 2027-02-03 |
| Last changed | 2026-02-11 |
| Status | client transfer prohibited |
Sources
-
Value written to the EtherRAT resolver contract 0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e by operator wallet 0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610 on 2026-02-03, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-02-03, the day it was written, through Key-Systems GmbH with nameservers ns1.suspendedpage.com and ns2.suspendedpage.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. Its nameservers now point at a suspended-page parking service, so it may have been suspended after the write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.
EtherRAT resolver contract 0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e — Chollima Hunter (on-chain observation) -
Value written to the EtherRAT resolver contract 0xae35eb8fa62b2ccbb88a495ec7fd1e2f2b4a170e by operator wallet 0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610 on 2026-02-03, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-02-03, the day it was written, through Key-Systems GmbH with nameservers ns1.suspendedpage.com and ns2.suspendedpage.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. Its nameservers now point at a suspended-page parking service, so it may have been suspended after the write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution.
EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.