NullReceiver: DPRK Contagious Interview campaign evolves blockchain C2 with stealthier wallet-trail technique via trojanized npm packages — Threadlinqs Intelligence
As of 2026-08-13, NullReceiver: DPRK Contagious Interview campaign evolves blockchain C2 with stealthier wallet-trail technique via trojanized npm packages is a high-severity supply chain threat attributed to UNC1069 (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1856 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Updated: 2026-08-13 · 2 updates · revalidated 1×
Attribution: UNC1069 · North Korea (DPRK) · FINANCIAL
NullReceiver is a novel blockchain-based C2 resolution technique that encodes the C2 IP address directly in the bytes of a zero-value, zero-data Ethereum transaction recipient address — not in
NullReceiver represents the latest evolution in DPRK threat actors' iterative refinement of blockchain-based command-and-control (C2) channels, continuing a trajectory that has moved from obfuscator-driven strings to custom encoding, fixed domains, blockchain resolvers, EtherHiding, and now the wallet-trail technique. Discovered by Amazon Inspector and independently documented by OpenSourceMalware (Paul McCarty) on August 2-3, 2026, NullReceiver was found embedded in two trojanized npm packages: bianira-ui@1.27.0 and fluid-type-ui@2.0.8, both marketed as Tailwind CSS plugin lookalikes with no legitimate functionality.
The technical mechanism is deliberately minimal. The malware hardcodes the Ethereum wallet address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a belonging to the attacker. At runtime, it performs an HTTPS JSON-RPC query against one of three hardcoded RPC endpoints (1rpc.io/eth, eth.drpc.org, eth.blockscout.com) to retrieve the wallet's most recent outbound transaction. Critically, this transaction is a zero-value, zero-data transfer — the cheapest possible Ethereum transaction shape — with the input field containing only '0x' (empty calldata). The C2 IP address (166.88.134.62) is decoded directly from the first 4 bytes of the recipient address, while trailing bytes spell the ASCII marker string 'helloipbot!!' for operator tooling identification. The malware then connects to the decoded C2 server over HTTP on ports 80 or 443 and fetches XOR-encrypted payloads from paths /0x/ls and /0x/cls, decrypting with a 16-byte key before passing to eval() or executing via node -e, with a prelude binding global.r=require and global.m=module.
The two packages use different obfuscation strategies. bianira-ui@1.27.0 embeds the malicious code as an appended top-level IIFE in plugin.js using \uXXXX unicode escapes for all network identifiers to evade static inspection. fluid-type-ui@2.0.8 hides the code block in src/index.js behind a long run of tab characters that push it off-screen in most editors. Both execute automatically on any require() or import(), with no npm install --ignore-scripts bypass possible since the code runs at module load time, not in a postinstall hook.
NullReceiver differs from EtherHiding in several critical ways. EtherHiding embeds C2 payloads in the calldata field of transactions to a fixed burn address (0x000...dEaD), which creates a predictable blockchain landmark that defenders can continuously monitor. NullReceiver instead encodes the C2 IP in a made-up, disposable recipient address that changes per lookup, with empty calldata, leaving no fixed address to monitor and only minimal on-chain artifacts. The trade-off is capacity: NullReceiver can only fit an IP address or small token, whereas EtherHiding can embed full URLs or scripts. Both techniques share the structural weakness of reusing the same sending wallet across campaigns, making the wallet itself the critical detection surface.
The packages are attributed to the DPRK (North Korea) threat cluster tracked as UNC1069/Sapphire Sleet/BlueNoroff/TA444 under the broader Lazarus Group umbrella, specifically the Contagious Interview campaign (first documented by Palo Alto Unit 42 in November 2023). This campaign has deployed over 1,700 malicious packages across five package ecosystems (npm, PyPI, Go Modules, crates.io, Packagist) since January 2025, with a malware arsenal including BeaverTail, InvisibleFerret, OtterCookie, FlexibleFerret, and WAVESHAPER.V2. The C2 IP 166.88.134.62 is hosted on AS18779 (EGIHosting / Ace Data Centers II, L.L.C., Orem, Utah) and was also used in the July 2026 Joyfill npm supply chain compromise (Socket.IO RAT + OmniStealer), linking the two incidents. The detection tag 'A10-npm3!' embedded in the NullReceiver code provides a campaign-level attribution marker.
Defenders should treat the attacker wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a as a reusable detection beacon, monitor for any npm package containing hardcode
Target sectors: technology, finance, cryptocurrency, software-development
Target regions: Global
Update History
- 2026-08-13 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 63 community-related indicator(s).
- 2026-08-05 — Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain (DPRK): What changed No severity, exploitability, or status escalation — both reports agree HIGH / ACTIVE / ACTIVE. The update expands MITRE coverage (Resource Development T1588.002/T1608.001, T1204.005, T1027.013, Fallback Channels T1008, Ingress
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195, T1195.001, T1059, T1059.007, T1204, T1204.002, T1102.002, T1071, T1071.001, T1573
