Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) method that conceals the C2 server IP deal with inside a made-up vacation spot deal with of a very empty Ethereum switch.
The brand new useless drop resolver strategy, noticed in two trojanized npm packages “bianira-ui” and “fluid-type-ui,” has been codenamed NullReceiver by OpenSourceMalware, which has described it as a “deliberate enchancment on EtherHiding.” The exercise has been linked to North Korea.
Related articles
The packages are at present now not out there for obtain from npm. Nevertheless, statistics present that they’ve been downloaded a couple of hundred instances since they have been first revealed on July 28, 2026 –
- bianira-ui (109 downloads), uploaded by an npm consumer named “npmuser1101”
- fluid-type-ui (587 downloads), uploaded by an npm consumer named “npmuser3002”
EtherHiding was first publicly documented by Guardio Labs in October 2023 as a covert strategy that includes embedding nefarious code inside a smart contract on a public blockchain like BNB Sensible Chain (BSC) or Ethereum. The method heralded the “subsequent degree of bulletproof internet hosting” because it improves operational resilience within the face of takedowns.
Using EtherHiding by North Korean hacking teams was detailed by Google Menace Intelligence Group (GTIG) late final 12 months in reference to Contagious Interview, a long-running marketing campaign that goals to deceive potential targets by approaching them on LinkedIn with profitable job alternatives and asking them to full an evaluation that leads to malware deployment.
The most recent growth signifies that the risk actors are additional refining their techniques and making it troublesome for defenders to detect.
“As an alternative of hardcoding a C2 deal with or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP instantly within the bytes of the recipient deal with of a zero-value, zero-data Ethereum switch,” safety researcher Paul McCarty mentioned.
“The malware appears up the attacker’s pockets, reads the vacation spot deal with of its most up-to-date outbound transaction, and decodes a C2 IP straight from these deal with bytes, with no sensible contract and no payload area concerned.”
By embedding the C2 IP deal with on this method, NullReceiver goals to deal with one of many main shortcomings of EtherHiding, which requires a set, publicly identified vacation spot deal with — one that may be tracked by defenders as new transactions containing the payload, the C2 IP deal with, or the malicious script, happen for a gasoline price.
NullReceiver, in distinction, gives a non-existent vacation spot deal with. The deal with “exists” solely to present a means to encode the C2 IP deal with inside itself. This, in flip, makes attribution troublesome, because it eliminates the “fastened, watchable vacation spot.”
Neither of the newly found npm packages recognized as a part of the brand new marketing campaign, bianira-ui and fluid-type-ui, calls a sensible contract nor embeds any content material inside the transaction’s calldata area. As an alternative, the JavaScript libraries leverage the brand new method to extract the IP deal with and join to it. The complete sequence of actions on a sufferer machine is as follows –
- Search for a hard-coded attacker pockets (“0xa322e5f3d311d3080e6f0121063e9adc2490ef1a“)
- Discover its most up-to-date outbound transaction
- Learn that transaction’s vacation spot deal with
- Decode a C2 IP deal with instantly out of the deal with bytes by changing the primary 4 bytes from their hexadecimal illustration to their quantity equal
- Join to that IP deal with (“166.88.134[.]62”)
An examination of the pockets transactions reveals that the vacation spot “To” deal with for every of them is similar: “0xa658863ea658863e68656c6c6f6970626f742121.” Whereas “a658863e” turns into “166.88.134[.]62,” the trailing bytes “68656c6c6f6970626f742121” signify the ASCII string “helloipbot!!.”
As of writing, a complete of 68 transactions have taken place since July 27, 2026, a day earlier than the packages have been revealed.
What makes NullReceiver extra sneaky is the absence of a set goal and a fingerprint, not to point out the truth that the transactions are cheaper than earlier than. A vital distinction between the 2 strategies is that whereas EtherHiding makes it doable to smuggle a full URL or script, NullReceiver can solely encode a couple of bytes.
“NullReceiver by no means reuses a vacation spot,” OpenSourceMalware mentioned. “Each lookup is a brand-new, throwaway deal with that is by no means been seen earlier than. A NullReceiver transaction carries nothing further in any respect. There is no area to fingerprint, as a result of there is not any area.”
“Calldata prices gasoline per byte. EtherHiding pays for that. NullReceiver’s switch is totally clean, making it the most cost effective, least conspicuous transaction form on the community.”
