Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding, JADESNOW/INVISIBLEFERRET, SharkStealer)

Key facts for EtherHiding blockchain C2

Detection coverage for EtherHiding blockchain C2

As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2484 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: EtherHiding Dead-Drop Resolver Beaconing — Blockchain RPC/API + Known C2 Infrastructure

Detects outbound connections to public blockchain RPC/API providers (Infura, Alchemy, BSC-dataseed, Blockchair, Blockcypher, Ethplorer, Binplorer) or eth_call JSON-RPC invocations from non-Web3-development processes, together with connections to the known EtherHiding-resolved C2 IPs/domains across SharkStealer, SleepyDuck, Tsundere, and UNC5142's Vidar/Rhadamanthys infostealer infrastructure. Also matches the community-corroborated (TL_OSINT_Scan) DPRK/Kimsuky dynu.net dead-drop cluster and the Vidar dead-drop-via-legitimate-service pattern (Steam profile pages, Telegram channels, Epic Games API) observed as sibling infrastructure for this threat.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1102.001, T1071.001, T1573.001, T1090
• Data sources: proxy, firewall, dns, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=firewall OR index=dns
( (dest_ip IN ("84.54.44.48","185.28.119.179","196.251.72.192","103.246.145.201","193.24.123.68","62.60.226.179","95.217.240.67","91.240.118.2","118.194.249.91","152.32.138.81","45.91.168.240"))
  OR (dest_domain IN ("securemetricsapi.live","sleepyduck.xyz","saaadnesss.shop","ratatui.today","technavix.cloud") OR dest_domain="*.ntinvoicepload.dynu.net")
  OR (url="*eth_call*" OR url="*infura.io*" OR url="*alchemy.com*" OR url="*bsc-dataseed*" OR url="*blockchair.com*" OR url="*blockcypher.com*" OR url="*ethplorer.io*" OR url="*binplorer.com*")
  OR (url="*steamcommunity.com/profiles*" OR url="*telegram.me/s11yme*" OR url="*dev.epicgames.com/community/api/user_profiles*") )
NOT (process_name IN ("node.exe","geth.exe","truffle.exe","hardhat.exe") AND user_group="web3_dev")
| eval indicator=case(match(url,"eth_call|infura|alchemy|bsc-dataseed|blockchair|blockcypher|ethplorer|binplorer"),"blockchain_rpc_dead_drop_resolver", match(url,"steamcommunity|telegram\.me|epicgames"),"vidar_legitimate_service_dead_drop", match(dest_domain,"ntinvoicepload\.dynu\.net"),"kimsuky_dga_c2_cluster_osint", 1==1,"known_c2_ip_or_domain")
| table _time, src_ip, dest_ip, dest_domain, url, user, process_name, indicator
| sort -_time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in ("84.54.44.48","185.28.119.179","196.251.72.192","103.246.145.201","193.24.123.68","62.60.226.179","95.217.240.67","91.240.118.2","118.194.249.91","152.32.138.81","45.91.168.240")
    or RemoteUrl has_any ("securemetricsapi.live","sleepyduck.xyz","saaadnesss.shop","ratatui.today","technavix.cloud","ntinvoicepload.dynu.net","eth_call","infura.io","alchemy.com","bsc-dataseed","blockchair.com","blockcypher.com","ethplorer.io","binplorer.com","steamcommunity.com/profiles","telegram.me/s11yme","dev.epicgames.com/community/api/user_profiles")
| where InitiatingProcessFileName !in~ ("node.exe","geth.exe","truffle.exe","hardhat.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

Sigma

title: EtherHiding Dead-Drop Resolver — Blockchain RPC/API Beaconing to Known C2 Infrastructure
id: 9d2b7e44-1a5c-4f8e-b3d6-5e7a0c9f2b18
status: experimental
description: Detects network connections to known EtherHiding-derived C2 IPs/domains (SharkStealer, SleepyDuck, Tsundere) or to public blockchain RPC/API providers used as dead-drop resolvers (Infura, Alchemy, BSC-dataseed, Blockchair, Blockcypher, Ethplorer, Binplorer) originating from a process that is not recognized Web3 development tooling.
references:
    - https://cybersecuritynews.com/sharkstealer-using-etherhiding-pattern/
    - https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.command-and-control
    - attack.t1102.001
    - attack.t1071.001
    - attack.t1573.001
    - attack.t1090
    - attack.tool.etherhiding
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationIp:
            - '84.54.44.48'
            - '185.28.119.179'
            - '196.251.72.192'
            - '103.246.145.201'
            - '193.24.123.68'
            - '62.60.226.179'
            - '95.217.240.67'
            - '91.240.118.2'
    selection_rpc:
        DestinationHostname|contains:
            - 'infura.io'
            - 'alchemy.com'
            - 'bsc-dataseed'
            - 'blockchair.com'
            - 'blockcypher.com'
            - 'ethplorer.io'
            - 'binplorer.com'
    filter_devtools:
        Image|endswith:
            - '\node.exe'
            - '\geth.exe'
            - '\truffle.exe'
            - '\hardhat.exe'
    condition: (selection_c2 or selection_rpc) and not filter_devtools
falsepositives:
    - Legitimate Web3/blockchain developer tooling querying public RPC endpoints
    - Crypto wallet browser extensions performing normal balance/transaction lookups
level: high

Known false positives:

• Legitimate Web3 developer tooling or crypto wallet extensions querying public RPC/API endpoints

Tuning notes: Maintain an allowlist of known internal Web3 development hosts/process hashes; if RPC-provider false positives are high, restrict the RPC-provider match to hosts outside a defined developer OU/group rather than relying on process name alone. The dynu.net and Steam/Telegram/Epic Games indicators are community/OSINT-tier (TL_OSINT_Scan) corroboration for related sibling infrastructure, not confirmed ground truth for this specific threat — weight accordingly and pattern-match the *.ntinvoicepload.dynu.net subdomain as a DGA family rather than a static string.

• 🔒 Malicious npm Typosquat or Open VSX Extension Install — SleepyDuck/Tsundere Supply-Chain · unlock with TL Creds
• 🔒 INVISIBLEFERRET Backdoor Beacon on TCP/3306 with System Fingerprinting and ZIP Exfil Staging · unlock with TL Creds
• 🔒 Tsundere Botnet WebSocket C2 and Blockchain-API Dead-Drop Query · unlock with TL Creds
• 🔒 ClickFix Fake-Verification Clipboard-Paste Execution via Run Dialog · unlock with TL Creds
• 🔒 Scripting-Runtime Autostart Persistence — Tsundere Node.js Botnet Pattern · unlock with TL Creds
• 🔒 SharkStealer eth_call Function-Selector Dead-Drop C2 Resolution · unlock with TL Creds
• 🔒 Browser-Spawned Script Interpreter — ClickFix/CLEARSHORT Fake-Update Lure · unlock with TL Creds
• 🔒 Autostart Persistence with Browser/Crypto-Wallet Credential Store Access — INVISIBLEFERRET/BEAVERTAIL · unlock with TL Creds

Indicators of compromise for EtherHiding blockchain C2

As of 2026-09-13, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2484.

Sample indicators (3 of 29)

• IP address: 84.54.44[.]48
• Domain: securemetricsapi[.]live
• URL: hxxps://kimbeech[.]cfd/cap/verify.sh

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How EtherHiding blockchain C2 works

UNC5142's ClearFake/CLEARSHORT loader compromised roughly 14,000 WordPress sites by June 2025 to distribute Vidar, Lumma, Rhadamanthys, and Atomic infostealers, while UNC5342 became the first nation-state actor to adopt the technique, using JADESNOW and INVISIBLEFERRET in its Contagious Interview fake-job-offer campaign against crypto/tech developers. Independent malware families (Tsundere, SleepyDuck, SharkStealer) have since implemented the same dead-drop-resolver pattern, indicating broad TTP diffusion across the criminal ecosystem.

Since late 2023, Google Threat Intelligence Group/Mandiant have tracked UNC5142, a financially motivated actor abusing BNB Smart Chain smart contracts as a resilient, takedown-resistant delivery backbone for the ClearFake (later CLEARSHORT) fake-browser-update injection campaign. Beginning with a single smart contract and Base64 encoding in May 2024, UNC5142 evolved by November 2024 into a three-tier proxy architecture: a first-level "router" contract (0x9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53) that returns the ABI/address of a second-level "logic" contract (0x8FBA1667BEF5EdA433928b220886A830488549BD) performing victim fingerprinting (STUN-based real-IP extraction, OS detection, ClickFix lure delivery), which in turn points to a third-level "storage" contract (0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA) holding AES-GCM-encrypted landing-page HTML, decryption keys, and next-stage payload URLs. Because these are read-only eth_call queries rather than state-changing transactions, the retrievals never appear in blockchain explorers or transaction histories, and updating the payload costs UNC5142 only $0.25-$1.50 in gas fees — enabling rapid, cheap pivots that outpace conventional domain/IP blocklisting. By June 2025, Google had flagged roughly 14,000 compromised WordPress pages exhibiting UNC5142 injection patterns; the group used a four-stage delivery chain (HTA/XLL dropper -> PowerShell loader -> encrypted memory-only blob hosted on GitHub/MediaFire/Cloudflare Pages -> final payload) to drop Vidar, Lumma (LUMMAC.V2), Rhadamanthys (RADTHIEF), and Atomic (AMOS) infostealers on Windows and macOS victims lured via fake Chrome updates, fake CAPTCHAs, and fake Cloudflare "unusual traffic" pages. Activity paused after July 23, 2025. Separately, starting February 2025, DPRK-attributed UNC5342 became the first confirmed nation-state actor to weaponize EtherHiding, embedding it in the long-running "Contagious Interview" social-engineering campaign: fake recruiters (posing as firms including BlockNovas LLC, Angeloper Agency, and SoftGlideLLC) approach cryptocurrency and software developers on LinkedIn, pivot the conversation to Telegram/Discord, and deliver a coding "technical assessment" hosted on GitHub or as npm packages that conceals the JADESNOW JavaScript downloader. JADESNOW retrieves Base64/XOR-encoded payloads from a BNB Smart Chain contract (0x8eac3198dd72f3e07108c4c7cff43108ad48a71c, updated 20+ times over four months at roughly $1.37/update) and chains into BEAVERTAIL (a JS infostealer targeting crypto wallets and browser extensions) and ultimately INVISIBLEFERRET, a Python/JavaScript backdoor that beacons device/OS fingerprint data over a C2 channel on port 3306, harvests credentials and session cookies from Chrome, Edge, MetaMask, Phantom, and 1Password, and exfiltrates a ZIP archive to both a remote server and a private Telegram chat. UNC5342 additionally relies on centralized blockchain-API abstraction layers (Blockchair, Blockcypher, Ethplorer, Binplorer) rather than direct RPC nodes, querying transactions sent to Ethereum's conventional burn address (0x000...dEaD) as a dead-drop resolver for encoded C2 instructions — a centralization point defenders can pressure. The same underlying technique has since propagated independently into the wider malware ecosystem. Kaspersky's GReAT documented Tsundere, a Node.js botnet distributed since October 2024 via 287 typosquatted npm packages (impersonating Puppeteer, Bignum.js, and other libraries) and later via game-themed (Valorant/CS2/R6X) MSI/PowerShell installers that side-load Node.js and persist three legitimate npm packages (ws, ethers, pm2); Tsundere resolves rotating WebSocket C2 endpoints from an Ethereum contract (0xa1b40044EBc2794f207D45143Bd82a1B86156c6b) via setString(), negotiates an AES key/IV over the WebSocket, and is attributed to a Russian-speaking actor "koneko" who also sells access through a self-service "Tsundere Netto v2.4.4" panel and monetizes bots as SOCKS proxies. SleepyDuck, a malicious Open VSX/VS Code Solidity extension (publisher juan-bianco, package solidity-vlang) published benign on October 31, 2025 and weaponized November 1, 2025 after accumulating roughly 14,000 downloads, installs a remote-access trojan that beacons hostname/username/MAC/timezone to sleepyduck[.]xyz every 30 seconds and falls back to an Ethereum contract (0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465) to fetch an updated C2 address if the primary domain is taken down. SharkStealer, a Golang infostealer, queries BNB Smart Chain Testnet contracts (0xc2c25784E78AeE4C2Cb16d40358632Ed27eeaF8E and 0x3dd7a9c28cfedf1c462581eb7150212bcf3f9edf) via the eth_call function selector 0x24c12bf6 to retrieve an IV+encrypted-payload tuple, decrypted with a hardcoded AES-CFB key to reveal live C2 servers (84.54.44[.]48, securemetricsapi[.]live). Across all five families, the common thread is the same defensive blind spot: because the malicious read occurs at the JSON-RPC/API layer rather than as an on-chain state change, standard blockchain monitoring and transaction-based blocklists do not see it, and disruption requires either RPC/API-provider cooperation or client-side detection of eth_call patterns and hardcoded contract addresses.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218.005 System Binary Proxy Execution: Mshta

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1102.001 Web Service: Dead Drop Resolver; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1566 Phishing; T1566.002 Phishing: Spearphishing Link

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Remediation for EtherHiding blockchain C2

Immediate actions

• Block egress to public blockchain RPC endpoints (Infura, Alchemy, BSC-dataseed, data-seed-prebsc nodes) from non-developer/non-Web3 endpoints
• Block or alert on the specific malicious C2 domains and IPs identified (sleepyduck[.]xyz, securemetricsapi[.]live, 84.54.44[.]48, saaadnesss[.]shop, ratatui[.]today, and Tsundere WebSocket hosts)
• Remove/quarantine the juan-bianco.solidity-vlang Open VSX extension and the 287 identified typosquatted npm packages from developer environments
• Alert on outbound eth_call / JSON-RPC method invocations originating from non-Web3-development processes or browser sessions on business endpoints

Workarounds

• Enforce Chrome Enterprise DownloadRestrictions blocking .exe/.msi/.bat/.dll/.hta/.xll from browser downloads
• Restrict mshta.exe and wscript.exe execution via application control policies
• Require WordPress plugin/theme/core patching and file-integrity monitoring to reduce the initial injection vector for ClearFake/CLEARSHORT

Longer-term hardening

• Deploy EDR with behavioral detection for mshta/PowerShell chains launched from browser or Office processes (UNC5142 CLEARSHORT chain)
• Implement software supply-chain vetting (SBOM review, dependency pinning, install-time scanning) for npm and VS Code/Open VSX marketplace installs
• Train developers and crypto-adjacent staff on the Contagious Interview fake-recruiter/fake-technical-assessment social engineering pattern
• Monitor for hardcoded smart contract addresses and Web3 library (web3.js/ethers.js) loading in binaries and browser processes outside expected developer tooling

Affected and fixed versions

• WordPress (self-hosted) — WordPress sites with vulnerable/outdated plugins, themes, or core
  Vulnerable versions: indiscriminate - any unpatched WordPress install exploitable via plugin/theme/DB injection
  Fixed in: N/A - requires plugin/theme/core patching and file-integrity monitoring, not a single vendor fix
• Open VSX / VS Code Marketplace — juan-bianco.solidity-vlang extension
  Vulnerable versions: 0.0.8 through 0.1.3 (malicious from Nov 1, 2025 update onward)
  Fixed in: none - extension remained live on Open VSX with only a platform warning at time of reporting
• npm Registry — Typosquatted packages impersonating Puppeteer, Bignum.js, and other popular libraries
  Vulnerable versions: 287 identified malicious packages (October 2024 campaign)
  Fixed in: removed from npm registry
• Cross-platform endpoints — Windows, macOS, and Linux systems belonging to crypto/tech developers and general users
  Vulnerable versions: N/A - social engineering and supply-chain delivery vector, not a specific software version

Timeline of EtherHiding blockchain C2

• 2023-12-01 Google Threat Intelligence Group/Mandiant begin tracking UNC5142's blockchain-abusing ClearFake distribution activity.
• 2024-05-01 UNC5142 begins using a single BNB Smart Chain smart contract with Base64 encoding to deliver CLEARSHORT payloads, disguised as a fake Chrome update.
• 2024-10-01 Threat actor 'koneko' launches a typosquatting campaign publishing 287 malicious npm packages impersonating Puppeteer, Bignum.js, and other popular libraries, seeding the locked-ioc-29 botnet across Windows, Linux, and macOS.
• 2024-11-24 UNC5142 upgrades to a three-tier smart-contract proxy architecture (router/logic/storage contracts) with AES-GCM encrypted payloads, and its main operator wallet (0xF5B962Cca374de0b769617888932250363C5971B) is created and funded with 0.1 BNB via the OKX exchange.
• 2025-02-01 DPRK-linked UNC5342 begins using EtherHiding within its Contagious Interview campaign, becoming the first confirmed nation-state actor to weaponize the technique via the locked-ioc-28 loader.
• 2025-02-18 UNC5142 deploys a parallel secondary set of three smart contracts and a second operator wallet, indicating operational expansion.
• 2025-06-01 Google identifies approximately 14,000 compromised WordPress pages exhibiting UNC5142/ClearFake injection behavior.
• 2025-07-23 UNC5142's ClearFake/CLEARSHORT activity is last observed before an apparent operational pause or pivot.
• 2025-08-19 locked-ioc-29 operators push a smart-contract-recorded update rotating the WebSocket C2 address to locked-ioc-20:1234.
• 2025-10-16 Google Cloud/Mandiant (GTIG) publicly disclose the UNC5142 EtherHiding campaign and, in a companion post, UNC5342's DPRK adoption of the technique.
• 2025-10-24 SharkStealer's use of BNB Smart Chain Testnet contracts as a dead-drop C2 resolver is publicly documented (VMRay/Cyber Security News).
• 2025-10-31 The juan-bianco.solidity-vlang VS Code/Open VSX extension is published in a benign form.
• 2025-11-01 SleepyDuck's malicious update (introducing RAT and Ethereum-backed C2 fallback) is pushed, after the extension had already reached roughly 14,000 downloads.
• 2025-11-04 Kaspersky GReAT publicly discloses the locked-ioc-29 botnet's Node.js/Ethereum smart-contract C2 architecture on Securelist.
• 2025-12-12 Netlas publishes a consolidated analysis tracing the evolution of C2 infrastructure from centralized/IRC servers to the blockchain-based EtherHiding pattern shared across UNC5142, UNC5342, locked-ioc-29, SleepyDuck, and SharkStealer.

Sources cited for EtherHiding blockchain C2

• New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware Google Cloud · Vendor report · 2025-10-16
• DPRK Adopts EtherHiding for Command and Control Google Cloud · Vendor report · 2025-10-16
• The Tsundere botnet uses the Ethereum blockchain to infect its targets Kaspersky Securelist · Research · 2025-11-04
• Cute but deadly: Kaspersky reveals the Tsundere botnet that plays hot-and-cold with Windows users Kaspersky · Vendor report · 2025-11-04
• The Evolution of C2: Centralized to On-Chain netlas.io · Blog · 2025-12-12
• Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites The Hacker News · News · 2025-10-16
• North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts The Hacker News · News · 2025-10-16
• North Korean hackers use EtherHiding to hide malware on the blockchain BleepingComputer · News · 2025-10-16
• North Korean hackers seen using blockchain to hide crypto-stealing malware The Record · News · 2025-10-16
• SharkStealer Using EtherHiding Pattern to Resolve Communications With C2 Channels cybersecuritynews.com · News · 2025-10-24
• Fake Solidity VSCode Extension on Open VSX Backdoors Developers BleepingComputer · News · 2025-11-05

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

More from UNC5342

• Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
• EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2
• ClickFix Campaign Uses EtherHiding to Deliver Node.js RAT, Infostealer, and Malicious Chrome Extension — DPRK Wallet Trail Exposed
• North Korean UNC5342 EtherHiding Campaign: Node.js RAT Delivered via Fake macOS Update Lures Using Ethereum Smart-Contract C2
• DPRK's UNC5342 Adopts EtherHiding to Deliver JADESNOW and INVISIBLEFERRET via Blockchain Smart Contracts
• astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow)

Previous and next in threat intel

• Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C Domains Surge +771% Previous report
• VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft Next report