North Korean Hackers Hide C2 Servers in Ethereum
North Korean cyber syndicates have long sought a method to cloak their command servers. Therefore, they want to render them untraceable and immune to blockades. Now, they utilize a seemingly ordinary cryptocurrency transfer. This transfer appears entirely empty at first glance. The transferred sum is zero. Furthermore, it bears no accompanying data. The sole element of consequence within such a transaction is the recipient address. Consequently, this address covertly harbors the command server IP address.
The Discovery of NullReceiver
Paul McCarthy recently unveiled this technique within the Ethereum blockchain. He publishes under the pseudonym 6mile. Researchers christened this method NullReceiver. It is embedded within two malicious npm packages. These packages are bianira-ui and fluid-type-ui. They masquerade as legitimate Tailwind CSS plugins. These packages connect directly to the North Korean “Contagious Interview” campaign. This campaign notoriously targets developers through fabricated employment assessments.
Moving Beyond EtherHiding
Previously, these threat actors employed a comparable stratagem dubbed EtherHiding. In that iteration, operators dispatched a transaction to a well-known token “burn address”. Meanwhile, they concealed the command server address within the transaction data field. Sometimes, they even hid an entire malicious script there. However, the inherent frailty of this scheme lay in its static destination address. Cybersecurity specialists thoroughly documented and monitored this exact address.
How the NullReceiver Technique Works
NullReceiver effectively eradicates this specific vulnerability. First, the malicious code queries a pre-established adversary wallet. Next, it isolates the most recent outbound transaction. Finally, the code extracts the recipient address. This address never actually intends to receive funds. Rather, developers artificially engineered it for a specific purpose. Upon decryption, its bytes manifest as the command server IP address. In the discovered specimen, the recipient address resolved to the IP 166.88.134.62. Additionally, it terminated with the string “helloipbot!!”. The architects left this string as a distinctive signature.
Challenges in Detection
This paradigm notably lacks a persistent, trackable address. Furthermore, the transaction harbors no data identifiable through formal heuristics. The transfer itself incurs the absolute minimum network fee possible. Consequently, early automated detection becomes virtually impossible. Security teams only suspect malicious activity after they discover and analyze the package.
Tracking the Adversary Wallets
Conversely, the adversarial wallet orchestrating these transfers is frequently repurposed. Attackers use it across many disparate campaigns. Therefore, upon initial detection, defenders can continuously monitor it. This process closely resembles how analysts monitored burn addresses during the EtherHiding epoch. McCarthy observes that North Korean operators routinely sophisticate their arsenals. They usually do this the moment a prior iteration surfaces in public reports.
Future Implications and Mitigation
He anticipates a major shift in tactics soon. The NullReceiver technique will likely supplant EtherHiding entirely. It will become the paramount method for clandestine command and control within npm-based campaigns. Organizations can mitigate these perils by rigorously verifying package provenance. They must check the reputation of npm packages prior to installation. Moreover, vigilant monitoring of network connections remains imperative. Teams must proactively block IP addresses and wallets flagged as indicators of compromise.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
