# Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding, JADESNOW/INVISIBLEFERRET, SharkStealer)

> Multiple financially-motivated crews and the DPRK-linked UNC5342 threat actor have converged on "EtherHiding" — resolving C2 addresses and encrypted payloads via read-only eth_call queries against immutable BNB Smart Chain/Ethereum smart contracts, avoiding on-chain transaction traces and defeating domain/IP takedowns. UNC5142's ClearFake/CLEARSHORT loader compromised roughly 14,000 WordPress sites by June 2025 to distribute Vidar, Lumma, Rhadamanthys, and Atomic infostealers, while UNC5342 became the first nation-state actor to adopt the technique, using JADESNOW and INVISIBLEFERRET in its Contagious Interview fake-job-offer campaign against crypto/tech developers. Independent malware families (Tsundere, SleepyDuck, SharkStealer) have since implemented the same dead-drop-resolver pattern, indicating broad TTP diffusion across the criminal ecosystem.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2484
- **ID:** TL-2026-2484
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** UNC5342 (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since late 2023, Google Threat Intelligence Group/Mandiant have tracked UNC5142, a financially motivated actor abusing BNB Smart Chain smart contracts as a resilient, takedown-resistant delivery backbone for the ClearFake (later CLEARSHORT) fake-browser-update injection campaign. Beginning with a single smart contract and Base64 encoding in May 2024, UNC5142 evolved by November 2024 into a three-tier proxy architecture: a first-level "router" contract (0x9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53) that returns the ABI/address of a second-level "logic" contract (0x8FBA1667BEF5EdA433928b220886A830488549BD) performing victim fingerprinting (STUN-based real-IP extraction, OS detection, ClickFix lure delivery), which in turn points to a third-level "storage" contract (0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA) holding AES-GCM-encrypted landing-page HTML, decryption keys, and next-stage payload URLs. Because these are read-only eth_call queries rather than state-changing transactions, the retrievals never appear in blockchain explorers or transaction histories, and updating the payload costs UNC5142 only $0.25-$1.50 in gas fees — enabling rapid, cheap pivots that outpace conventional domain/IP blocklisting. By June 2025, Google had flagged roughly 14,000 compromised WordPress pages exhibiting UNC5142 injection patterns; the group used a four-stage delivery chain (HTA/XLL dropper -> PowerShell loader -> encrypted memory-only blob hosted on GitHub/MediaFire/Cloudflare Pages -> final payload) to drop Vidar, Lumma (LUMMAC.V2), Rhadamanthys (RADTHIEF), and Atomic (AMOS) infostealers on Windows and macOS victims lured via fake Chrome updates, fake CAPTCHAs, and fake Cloudflare "unusual traffic" pages. Activity paused after July 23, 2025. Separately, starting February 2025, DPRK-attributed UNC5342 became the first confirmed nation-state actor to weaponize EtherHiding, embedding it in the long-running "Contagious Interview" social-engineering campaign: fake recruiters (posing as firms including BlockNovas LLC, Angeloper Agency, and SoftGlideLLC) approach cryptocurrency and software developers on LinkedIn, pivot the conversation to Telegram/Discord, and deliver a coding "technical assessment" hosted on GitHub or as npm packages that conceals the JADESNOW JavaScript downloader. JADESNOW retrieves Base64/XOR-encoded payloads from a BNB Smart Chain contract (0x8eac3198dd72f3e07108c4c7cff43108ad48a71c, updated 20+ times over four months at roughly $1.37/update) and chains into BEAVERTAIL (a JS infostealer targeting crypto wallets and browser extensions) and ultimately INVISIBLEFERRET, a Python/JavaScript backdoor that beacons device/OS fingerprint data over a C2 channel on port 3306, harvests credentials and session cookies from Chrome, Edge, MetaMask, Phantom, and 1Password, and exfiltrates a ZIP archive to both a remote server and a private Telegram chat. UNC5342 additionally relies on centralized blockchain-API abstraction layers (Blockchair, Blockcypher, Ethplorer, Binplorer) rather than direct RPC nodes, querying transactions sent to Ethereum's conventional burn address (0x000...dEaD) as a dead-drop resolver for encoded C2 instructions — a centralization point defenders can pressure. The same underlying technique has since propagated independently into the wider malware ecosystem. Kaspersky's GReAT documented Tsundere, a Node.js botnet distributed since October 2024 via 287 typosquatted npm packages (impersonating Puppeteer, Bignum.js, and other libraries) and later via game-themed (Valorant/CS2/R6X) MSI/PowerShell installers that side-load Node.js and persist three legitimate npm packages (ws, ethers, pm2); Tsundere resolves rotating WebSocket C2 endpoints from an Ethereum contract (0xa1b40044EBc2794f207D45143Bd82a1B86156c6b) via setString(), negotiates an AES key/IV over the WebSocket, and is attributed to a Russian-speaking actor "koneko" who also sells access through a self-service "Tsundere Netto v2.4.4" panel and monetizes bots as SOCKS proxies. SleepyDuck, a malicious Open VSX/VS Code Solidity extension (publisher juan-bianco, package solidity-vlang) published benign on October 31, 2025 and weaponized November 1, 2025 after accumulating roughly 14,000 downloads, installs a remote-access trojan that beacons hostname/username/MAC/timezone to sleepyduck[.]xyz every 30 seconds and falls back to an Ethereum contract (0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465) to fetch an updated C2 address if the primary domain is taken down. SharkStealer, a Golang infostealer, queries BNB Smart Chain Testnet contracts (0xc2c25784E78AeE4C2Cb16d40358632Ed27eeaF8E and 0x3dd7a9c28cfedf1c462581eb7150212bcf3f9edf) via the eth_call function selector 0x24c12bf6 to retrieve an IV+encrypted-payload tuple, decrypted with a hardcoded AES-CFB key to reveal live C2 servers (84.54.44[.]48, securemetricsapi[.]live). Across all five families, the common thread is the same defensive blind spot: because the malicious read occurs at the JSON-RPC/API layer rather than as an on-chain state change, standard blockchain monitoring and transaction-based blocklists do not see it, and disruption requires either RPC/API-provider cooperation or client-side detection of eth_call patterns and hardcoded contract addresses.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.006 Command and Scripting Interpreter: Python
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1218.005 System Binary Proxy Execution: Mshta
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1090 Proxy

## Sources

- [The Evolution of C2: Centralized to On-Chain](https://netlas.io/blog/evolution_of_c2_infrastructure/)
- [New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware)
- [DPRK Adopts EtherHiding for Command and Control](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites](https://thehackernews.com/2025/10/hackers-abuse-blockchain-smart.html)
- [North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [North Korean hackers seen using blockchain to hide crypto-stealing malware](https://therecord.media/north-korean-hackers-using-blockchain-hiding-malware)
- [The Tsundere botnet uses the Ethereum blockchain to infect its targets](https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/)
- [Cute but deadly: Kaspersky reveals the Tsundere botnet that plays hot-and-cold with Windows users](https://www.kaspersky.com/about/press-releases/cute-but-deadly-kaspersky-reveals-the-tsundere-botnet-that-plays-hot-and-cold-with-windows-users)
- [SharkStealer Using EtherHiding Pattern to Resolve Communications With C2 Channels](https://cybersecuritynews.com/sharkstealer-using-etherhiding-pattern/)
- [Fake Solidity VSCode Extension on Open VSX Backdoors Developers](https://www.bleepingcomputer.com/news/security/fake-solidity-vscode-extension-on-open-vsx-backdoors-developers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2484