Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding, JADESNOW/INVISIBLEFERRET, SharkStealer)
Blockchain-Based C2 Evolution (TL-2026-2484), also tracked as EtherHiding, is a high-severity tracked intrusion set, first published 2026-09-13. It is attributed to UNC5342 (North Korea) with high confidence, affects WordPress (self-hosted) WordPress sites with vulnerable/outdated, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1059.001), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-2484
- Threat ID
- TL-2026-2484
- Also known as
- EtherHiding, Contagious Interview, ClearFake, CLEARSHORT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-09-13
- Last reviewed
- 2026-09-13
- Attribution
- UNC5342
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, software development, financial services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Blockchain-Based C2 Evolution
Malware and tooling: BeaverTail - S1246, ClearFake, InvisibleFerret - S1245, JADESNOW, Rhadamanthys, Tsundere, Tsundere Botnet - S9034, Vidar, 0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA, 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c, 0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465, 0xa1b40044EBc2794f207D45143Bd82a1B86156c6b
Multiple financially-motivated crews and the DPRK-linked UNC5342 threat actor have converged on "EtherHiding" — resolving C2 addresses and encrypted payloads via read-only eth_call queries against immutable BNB Smart Chain/Ethereum smart contracts, avoiding on-chain transaction traces and defeating domain/IP takedowns. UNC5142's ClearFake/CLEARSHORT loader compromised roughly 14,000 WordPress sites by June 2025 to distribute Vidar, Lumma, Rhadamanthys, and Atomic infostealers, while UNC5342 became the first nation-state actor to adopt the technique, using JADESNOW and INVISIBLEFERRET in its Contagious Interview fake-job-offer campaign against crypto/tech developers. Independent malware families (Tsundere, SleepyDuck, SharkStealer) have since implemented the same dead-drop-resolver pattern, indicating broad TTP diffusion across the criminal ecosystem.
How Blockchain-Based C2 Evolution works
Since late 2023, Google Threat Intelligence Group/Mandiant have tracked UNC5142, a financially motivated actor abusing BNB Smart Chain smart contracts as a resilient, takedown-resistant delivery backbone for the ClearFake (later CLEARSHORT) fake-browser-update injection campaign. Beginning with a single smart contract and Base64 encoding in May 2024, UNC5142 evolved by November 2024 into a three-tier proxy architecture: a first-level "router" contract (0x9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53) that returns the ABI/address of a second-level "logic" contract (0x8FBA1667BEF5EdA433928b220886A830488549BD) performing victim fingerprinting (STUN-based real-IP extraction, OS detection, ClickFix lure delivery), which in turn points to a third-level "storage" contract (0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA) holding AES-GCM-encrypted landing-page HTML, decryption keys, and next-stage payload URLs. Because these are read-only eth_call queries rather than state-changing transactions, the retrievals never appear in blockchain explorers or transaction histories, and updating the payload costs UNC5142 only $0.25-$1.50 in gas fees — enabling rapid, cheap pivots that outpace conventional domain/IP blocklisting. By June 2025, Google had flagged roughly 14,000 compromised WordPress pages exhibiting UNC5142 injection patterns; the group used a four-stage delivery chain (HTA/XLL dropper -> PowerShell loader -> encrypted memory-only blob hosted on GitHub/MediaFire/Cloudflare Pages -> final payload) to drop Vidar, Lumma (LUMMAC.V2), Rhadamanthys (RADTHIEF), and Atomic (AMOS) infostealers on Windows and macOS victims lured via fake Chrome updates, fake CAPTCHAs, and fake Cloudflare "unusual traffic" pages. Activity paused after July 23, 2025. Separately, starting February 2025, DPRK-attributed UNC5342 became the first confirmed nation-state actor to weaponize EtherHiding, embedding it in the long-running "Contagious Interview" social-engineering campaign: fake recruiters (posing as firms including BlockNovas LLC, Angeloper Agency, and SoftGlideLLC) approach cryptocurrency and software developers on LinkedIn, pivot the conversation to Telegram/Discord, and deliver a coding "technical assessment" hosted on GitHub or as npm packages that conceals the JADESNOW JavaScript downloader. JADESNOW retrieves Base64/XOR-encoded payloads from a BNB Smart Chain contract (0x8eac3198dd72f3e07108c4c7cff43108ad48a71c, updated 20+ times over four months at roughly $1.37/update) and chains into BEAVERTAIL (a JS infostealer targeting crypto wallets and browser extensions) and ultimately INVISIBLEFERRET, a Python/JavaScript backdoor that beacons device/OS fingerprint data over a C2 channel on port 3306, harvests credentials and session cookies from Chrome, Edge, MetaMask, Phantom, and 1Password, and exfiltrates a ZIP archive to both a remote server and a private Telegram chat. UNC5342 additionally relies on centralized blockchain-API abstraction layers (Blockchair, Blockcypher, Ethplorer, Binplorer) rather than direct RPC nodes, querying transactions sent to Ethereum's conventional burn address (0x000...dEaD) as a dead-drop resolver for encoded C2 instructions — a centralization point defenders can pressure. The same underlying technique has since propagated independently into the wider malware ecosystem. Kaspersky's GReAT documented Tsundere, a Node.js botnet distributed since October 2024 via 287 typosquatted npm packages (impersonating Puppeteer, Bignum.js, and other libraries) and later via game-themed (Valorant/CS2/R6X) MSI/PowerShell installers that side-load Node.js and persist three legitimate npm packages (ws, ethers, pm2); Tsundere resolves rotating WebSocket C2 endpoints from an Ethereum contract (0xa1b40044EBc2794f207D45143Bd82a1B86156c6b) via setString(), negotiates an AES key/IV over the WebSocket, and is attributed to a Russian-speaking actor "koneko" who also sells access through a self-service "Tsundere Netto v2.4.4" panel and monetizes bots as SOCKS proxies. SleepyDuck, a malicious Open VSX/VS Code Solidity extension (publisher juan-bianco, package solidity-vlang) published benign on October 31, 2025 and weaponized November 1, 2025 after accumulating roughly 14,000 downloads, installs a remote-access trojan that beacons hostname/username/MAC/timezone to sleepyduck[.]xyz every 30 seconds and falls back to an Ethereum contract (0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465) to fetch an updated C2 address if the primary domain is taken down. SharkStealer, a Golang infostealer, queries BNB Smart Chain Testnet contracts (0xc2c25784E78AeE4C2Cb16d40358632Ed27eeaF8E and 0x3dd7a9c28cfedf1c462581eb7150212bcf3f9edf) via the eth_call function selector 0x24c12bf6 to retrieve an IV+encrypted-payload tuple, decrypted with a hardcoded AES-CFB key to reveal live C2 servers (84.54.44[.]48, securemetricsapi[.]live). Across all five families, the common thread is the same defensive blind spot: because the malicious read occurs at the JSON-RPC/API layer rather than as an on-chain state change, standard blockchain monitoring and transaction-based blocklists do not see it, and disruption requires either RPC/API-provider cooperation or client-side detection of eth_call patterns and hardcoded contract addresses.
MITRE ATT&CK techniques used in TL-2026-2484
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218.005 System Binary Proxy Execution: Mshta
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1102.001 Web Service: Dead Drop Resolver; T1573.001 Encrypted Channel: Symmetric Cryptography
Discovery
T1082 System Information Discovery
Initial Access
T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1566 Phishing; T1566.002 Phishing: Spearphishing Link
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Affected products and versions in Blockchain-Based C2 Evolution
- WordPress (self-hosted) — WordPress sites with vulnerable/outdated plugins, themes, or core
Vulnerable versions: indiscriminate - any unpatched WordPress install exploitable via plugin/theme/DB injection
Fixed in: N/A - requires plugin/theme/core patching and file-integrity monitoring, not a single vendor fix - Open VSX / VS Code Marketplace — juan-bianco.solidity-vlang extension
Vulnerable versions: 0.0.8 through 0.1.3 (malicious from Nov 1, 2025 update onward)
Fixed in: none - extension remained live on Open VSX with only a platform warning at time of reporting - npm Registry — Typosquatted packages impersonating Puppeteer, Bignum.js, and other popular libraries
Vulnerable versions: 287 identified malicious packages (October 2024 campaign)
Fixed in: removed from npm registry - Cross-platform endpoints — Windows, macOS, and Linux systems belonging to crypto/tech developers and general users
Vulnerable versions: N/A - social engineering and supply-chain delivery vector, not a specific software version
Remediation for Blockchain-Based C2 Evolution
Immediate actions
- Block egress to public blockchain RPC endpoints (Infura, Alchemy, BSC-dataseed, data-seed-prebsc nodes) from non-developer/non-Web3 endpoints
- Block or alert on the specific malicious C2 domains and IPs identified (sleepyduck[.]xyz, securemetricsapi[.]live, 84.54.44[.]48, saaadnesss[.]shop, ratatui[.]today, and Tsundere WebSocket hosts)
- Remove/quarantine the juan-bianco.solidity-vlang Open VSX extension and the 287 identified typosquatted npm packages from developer environments
- Alert on outbound eth_call / JSON-RPC method invocations originating from non-Web3-development processes or browser sessions on business endpoints
Workarounds
- Enforce Chrome Enterprise DownloadRestrictions blocking .exe/.msi/.bat/.dll/.hta/.xll from browser downloads
- Restrict mshta.exe and wscript.exe execution via application control policies
- Require WordPress plugin/theme/core patching and file-integrity monitoring to reduce the initial injection vector for ClearFake/CLEARSHORT
Longer-term hardening
- Deploy EDR with behavioral detection for mshta/PowerShell chains launched from browser or Office processes (UNC5142 CLEARSHORT chain)
- Implement software supply-chain vetting (SBOM review, dependency pinning, install-time scanning) for npm and VS Code/Open VSX marketplace installs
- Train developers and crypto-adjacent staff on the Contagious Interview fake-recruiter/fake-technical-assessment social engineering pattern
- Monitor for hardcoded smart contract addresses and Web3 library (web3.js/ethers.js) loading in binaries and browser processes outside expected developer tooling
Timeline of Blockchain-Based C2 Evolution
- Google Threat Intelligence Group/Mandiant begin tracking UNC5142's blockchain-abusing ClearFake distribution activity.
- UNC5142 begins using a single BNB Smart Chain smart contract with Base64 encoding to deliver CLEARSHORT payloads, disguised as a fake Chrome update.
- Threat actor 'koneko' launches a typosquatting campaign publishing 287 malicious npm packages impersonating Puppeteer, Bignum.js, and other popular libraries, seeding the Tsundere botnet across Windows, Linux, and macOS.
- UNC5142 upgrades to a three-tier smart-contract proxy architecture (router/logic/storage contracts) with AES-GCM encrypted payloads, and its main operator wallet (0xF5B962Cca374de0b769617888932250363C5971B) is created and funded with 0.1 BNB via the OKX exchange.
- DPRK-linked UNC5342 begins using EtherHiding within its Contagious Interview campaign, becoming the first confirmed nation-state actor to weaponize the technique via the JADESNOW loader.
- UNC5142 deploys a parallel secondary set of three smart contracts and a second operator wallet, indicating operational expansion.
- Google identifies approximately 14,000 compromised WordPress pages exhibiting UNC5142/ClearFake injection behavior.
- UNC5142's ClearFake/CLEARSHORT activity is last observed before an apparent operational pause or pivot.
- Tsundere operators push a smart-contract-recorded update rotating the WebSocket C2 address to 185.28.119[.]179:1234.
- Google Cloud/Mandiant (GTIG) publicly disclose the UNC5142 EtherHiding campaign and, in a companion post, UNC5342's DPRK adoption of the technique.
- SharkStealer's use of BNB Smart Chain Testnet contracts as a dead-drop C2 resolver is publicly documented (VMRay/Cyber Security News).
- The juan-bianco.solidity-vlang VS Code/Open VSX extension is published in a benign form.
- SleepyDuck's malicious update (introducing RAT and Ethereum-backed C2 fallback) is pushed, after the extension had already reached roughly 14,000 downloads.
- Kaspersky GReAT publicly discloses the Tsundere botnet's Node.js/Ethereum smart-contract C2 architecture on Securelist.
- Netlas publishes a consolidated analysis tracing the evolution of C2 infrastructure from centralized/IRC servers to the blockchain-based EtherHiding pattern shared across UNC5142, UNC5342, Tsundere, SleepyDuck, and SharkStealer.
Sources cited for Blockchain-Based C2 Evolution
- The Evolution of C2: Centralized to On-Chain
- New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
- DPRK Adopts EtherHiding for Command and Control
- Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
- North Korean hackers use EtherHiding to hide malware on the blockchain
- North Korean hackers seen using blockchain to hide crypto-stealing malware
- The Tsundere botnet uses the Ethereum blockchain to infect its targets
- Cute but deadly: Kaspersky reveals the Tsundere botnet that plays hot-and-cold with Windows users
- SharkStealer Using EtherHiding Pattern to Resolve Communications With C2 Channels
- Fake Solidity VSCode Extension on Open VSX Backdoors Developers
More in threat intel
- VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C Domains Surge +771%
- Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass
- China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Models
- Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)
Detection coverage for TL-2026-2484
As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2484 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.