North Korean Hackers Evolve C2 Technique Using Ethereum Transactions
Malicious npm packages 'bianira-ui' and 'fluid-type-ui' have been found using a novel technique to hide command-and-control server IP addresses within fabricated Ethereum transaction recipient addresses.
Cybersecurity researchers have identified a sophisticated evolution of the EtherHiding technique, dubbed NullReceiver, which North Korean threat actors are employing to conceal their command-and-control (C2) server IP addresses. This new method embeds the C2 IP directly within the recipient address of a zero-value, zero-data Ethereum transfer, making it significantly harder for defenders to track and disrupt malicious infrastructure.
The technique was observed in two trojanized npm packages, 'bianira-ui' and 'fluid-type-ui', which have since been removed from the npm registry. Despite their brief availability, these packages saw hundreds of downloads, indicating a potential reach into development environments. This development represents a deliberate improvement on the previously documented EtherHiding method, which relied on embedding malicious code within smart contracts on blockchains like Ethereum or BNB Smart Chain.
Unlike its predecessor, NullReceiver bypasses the need for a smart contract and avoids populating the transaction's calldata field. Instead, the malware queries a hard-coded attacker wallet, retrieves the destination address of its most recent outbound transaction, and then decodes the C2 IP address from the first four bytes of that address. This approach eliminates the fixed, publicly traceable destination address that defenders could monitor in the original EtherHiding technique.
"Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer," explained security researcher Paul McCarty. "The malware looks up the attacker's wallet, reads the destination address of its most recent outbound transaction, and decodes a C2 IP straight from those address bytes, with no smart contract and no payload field involved."
The specific wallet targeted in these attacks is '0xa322e5f3d311d3080e6f0121063e9adc2490ef1a'. The most recent outbound transaction from this wallet shows a destination address of '0xa658863ea658863e68656c6c6f6970626f742121'. The first four bytes, 'a658863e', translate to the IP address '166.88.134.62', while the trailing bytes '68656c6c6f6970626f742121' form the ASCII string 'helloipbot!!'. This demonstrates the direct encoding of both the C2 IP and a potential identifier.
This new method offers several advantages for threat actors. By using a non-existent destination address for the transaction, NullReceiver ensures that each lookup results in a brand-new, never-before-seen address. This eliminates any fixed fingerprint or target for defenders to track. Furthermore, because the transaction is completely blank, it incurs minimal gas fees, making it the cheapest and least conspicuous transaction shape on the Ethereum network.
The use of blockchain for C2 infrastructure is part of a broader trend by sophisticated threat actors, particularly those linked to North Korea, to enhance the resilience and stealth of their operations. The Google Threat Intelligence Group previously linked the original EtherHiding technique to North Korean campaigns like Contagious Interview, which used social engineering on LinkedIn to deliver malware. The refinement seen in NullReceiver highlights the continuous cat-and-mouse game between attackers and defenders, with threat actors constantly innovating to evade detection.
While the specific npm packages have been removed, the underlying technique poses a persistent threat. Developers are urged to remain vigilant about the dependencies they incorporate into their projects and to ensure their development environments are secure. The evolution of C2 communication methods underscores the need for advanced threat intelligence and proactive security measures to counter increasingly sophisticated supply chain attacks.