North Korean Hackers Use Empty Crypto Transfers to Hide Malware C2 Servers
North Korean threat actors are employing a novel technique called NullReceiver, embedding malware command-and-control server IP addresses within seemingly valueless Ethereum transactions.
North Korean-linked threat actors have developed a novel technique, dubbed NullReceiver, to conceal their malware command-and-control (C2) servers within seemingly innocuous Ethereum transactions. This method embeds the C2 server's IP address directly into the recipient address of a transaction that carries no actual cryptocurrency value, making it exceptionally difficult for security defenders to detect and disrupt. The technique was recently observed in two malicious npm packages, bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8, which impersonated legitimate Tailwind CSS plugins, thereby posing a significant supply-chain risk to unsuspecting developers.
Analysts at OpenSource Malware identified this campaign and noted its connection to the DPRK-linked Contagious Interview operation, which has a history of targeting developers through seemingly trustworthy projects and packages. The NullReceiver technique offers a significant advantage to attackers by leveraging the public blockchain as a resilient infrastructure for C2 communication. Unlike traditional methods that rely on domain names or fixed IP addresses that can be blocked or taken down, this approach allows attackers to retrieve new instructions from a decentralized and immutable ledger.
The NullReceiver mechanism operates by reading the recipient address from the latest outgoing transaction originating from an attacker-controlled Ethereum wallet. This recipient address is not a genuine destination for funds; instead, its address bytes are specifically crafted to encode the IP address of the malware's C2 server. Crucially, these transactions contain no payment value and no transaction input data, allowing them to blend seamlessly with legitimate blockchain activity. This lack of smart contract calls, hidden scripts, or payloads makes them invisible to standard security monitoring tools.
This method differs from previous blockchain-based C2 techniques like EtherHiding, which stored command data within transaction calldata or smart contracts. While NullReceiver is limited in the amount of data it can transmit—typically just an IP address—it is significantly cheaper to operate, less conspicuous on-chain, and avoids the predictable destination addresses that defenders can proactively monitor in EtherHiding campaigns. The decoded command server then directs infected systems to the subsequent stages of the attack.
The affected npm packages utilize Node.js code to query public Ethereum RPC services. They then examine the attacker wallet's most recent transfer, decode the recipient address to extract the C2 IP, and establish communication with the compromised server. Researchers performed static analysis and read-only blockchain checks to identify this threat, without executing the malicious packages themselves. The attack's integration into npm dependencies is particularly concerning, as compromised packages can infiltrate developer workstations, build systems, and software projects through routine installation commands.
To mitigate these risks, security teams are advised to meticulously review dependency updates before deployment. Monitoring for unexpected outbound blockchain RPC traffic and applications that inspect transaction recipient addresses are also crucial steps. Once a malicious wallet is identified, defenders can track its transfers to discover newly encoded infrastructure before compromised systems connect. Organizations should also consider restricting unnecessary access to cryptocurrency RPC providers, isolating machines that have installed the identified packages, and rotating any exposed developer credentials.
These precautions are vital as North Korean threat actors continue to refine their targeting of developers, increasingly relying on sophisticated social engineering and supply-chain compromises rather than solely exploiting software vulnerabilities. The NullReceiver technique represents a significant evolution in their methods, demonstrating an innovative approach to maintaining persistent C2 communication in a highly detectable manner.