# EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2

> Chainalysis reports a 440% surge in malicious blockchain writes since mid-2025 (2.06/day to 11.1/day) as nation-state actors adopt 'blockchain dead drops' (BDD) — storing malware payloads and C2 configuration directly in smart contracts and transactions across BNB Smart Chain, Ethereum, Polygon, TRON, Aptos, and Bitcoin to build takedown-resistant infrastructure. DPRK's UNC5342 pioneered state-backed use of the EtherHiding technique in its Contagious Interview campaign (JADESNOW/InvisibleFerret/BeaverTail), Iran's Ministry of Intelligence writes C2 routing data into Bitcoin OP_RETURN fields, and Russian-language criminals sell EtherHiding-based dead-drop C2 as a service (ErrTraffic), with nation-state actors now responsible for roughly two-thirds of new activity as of Q2 2026.

- **Published:** 2026-09-17T00:00:00Z
- **Last reviewed:** 2026-09-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2547
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-etherhiding-blockchain-dead-drops-tl-2026-2547.webp?v=fb71002e (Threadlinqs threat intel: EtherHiding: 440% Nation-State C2 Surge: Detection & IOCs (TL-2026-2547) — High severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-2547
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNC5342 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (2 shown free below)

## Description

'Blockchain dead drops' (BDD) describes a growing class of techniques in which threat actors write malware payloads, command-and-control (C2) configuration, or infrastructure pointers directly into public blockchain transactions or smart contract state, so infected devices can retrieve instructions on demand from infrastructure that cannot be seized, sinkholed, or taken down by law enforcement or hosting providers. Chainalysis documents that malicious on-chain writes rose 440% since mid-2025 (from 2.06 to 11.1 per day, a 420% increase over the trailing 12 months), and that state-linked groups now account for roughly two-thirds of new BDD activity and half of total activity by Q2 2026 — up from a landscape dominated almost entirely by financially motivated cybercriminals through early 2024.

The technique traces to mid-2023, when operators behind the ClearFake fake-browser-update campaign (tracked by Google as UNC5142) began storing obfuscated JavaScript in Binance Smart Chain (BSC) smart contracts after Cloudflare disrupted their prior server infrastructure — the first large-scale use of what Guardio Labs later named 'EtherHiding.' In April 2024, APNIC documented the Smargaft botnet (a portmanteau of 'smart contract' and the Gafgyt IoT botnet family) using BSC RPC queries to retrieve a rotating C2 IP for DDoS attacks and SOCKS5 proxying. By 2026, Trend Micro observed ClearFake operators using four coordinated BSC testnet contracts (a stage-1 dispatcher, OS-specific ClickFix payload contracts for Windows and macOS, and an execution tracker, all deployed from wallet 0xd71f4cdC84420d2bd07F50787B4F998b4c2d5290) to deliver SectopRAT and ACRStealer via fake CAPTCHA/ClickFix lures on compromised websites — using free testnet tokens so the C2 costs nothing to operate.

In February 2025, Google Threat Intelligence Group (GTIG) observed DPRK-linked UNC5342 (also tracked as TraderTraitor, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, Void Dokkaebi, and CL-STA-0240) adopt EtherHiding inside its long-running 'Contagious Interview' campaign — the first documented state-backed use of the technique. UNC5342 poses as recruiters on LinkedIn, Discord, and Telegram (using front entities such as BlockNovas LLC, Angeloper Agency, and SoftGlide LLC) and lures software/blockchain developers into running a fake technical-assessment repository. This drops the JADESNOW JavaScript downloader, which issues read-only eth_call JSON-RPC requests (via providers including Binplorer, Blockchair, Blockcypher, and Ethplorer) to a BSC smart contract (0x8eac3198dd72f3e07108c4c7cff43108ad48a71c, operated from owner address 0x9bc1355344b54dedf3e44296916ed15653844509, updated 20+ times in four months at roughly $1.37 per update) to fetch a base64/XOR-encoded second stage. That stage queries Ethereum transactions sent to the burn address 0x000...dEaD as a 'dead drop resolver' to retrieve the INVISIBLEFERRET JavaScript backdoor (arbitrary command execution, host enumeration, file exfiltration over port 3306) and, for higher-value targets, a Python variant plus BeaverTail — a credential/crypto-wallet stealer targeting MetaMask, Phantom, browser-stored passwords and credit cards, and 1Password data, exfiltrated as ZIP archives to attacker infrastructure and Telegram.

In August 2026, researchers identified NullReceiver, a stealthier DPRK evolution distributed through trojanized npm packages impersonating Tailwind CSS plugins (bianira-ui@1.27.0, fluid-type-ui@2.0.8, and related packages: post-css-transfer, scrollbar-hide-plugin, tailwind-anim, tailwind-animation-founder, tailwindcss-anim). Rather than a smart contract, NullReceiver looks up the most recent outbound transaction from a hardcoded attacker wallet (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a) and decodes a C2 IP directly from the first four bytes of the zero-value, zero-data destination address (e.g., destination 0xa658863ea658863e68656c6c6f6970626f742121 decodes to 166.88.134.62) — eliminating the smart-contract interactions, payload fields, and fixed addresses that made EtherHiding detectable, while remaining tied to reused DPRK wallet infrastructure shared with the PolinRider campaign across npm, Go, and PHP ecosystems.

Outside DPRK, Chainalysis attributes activity suspected to be linked to Iran's Ministry of Intelligence and Security writing encoded C2 routing data into Bitcoin OP_RETURN fields via small payments to a widely known, historically Satoshi-linked address, active since late 2024. Separately, a Russian-language actor using the handle 'LenAI' has since December 2025 advertised ErrTraffic, a malware-as-a-service framework (marketed at $380/month on Exploit.IN and Telegram) that compromises WordPress sites to serve ClickFix PowerShell lures, then resolves rotating payload-hosting domains via Polygon smart contract RPC lookups so the C2 infrastructure can be updated without touching the compromised sites. ErrTraffic has been observed delivering Vidar, Okobot, LegionLoader, OnionDrop, BabaDedaLoader, and a gRPC-over-Tor Node.js backdoor. Because outright blocking blockchain traffic is impractical for organizations that rely on legitimate Web3 services, defenders are advised to monitor outbound JSON-RPC/eth_call traffic to public blockchain endpoints as an early-warning signal, apply blockchain analytics to profile wallet-level adversary infrastructure, and restrict execution of code obtained through informal recruiting/interview channels and unvetted npm packages.

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1608.001 Upload Malware
- T1566.002 Spearphishing Link
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.006 Python
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Trojanized npm Package Install Impersonating Tailwind CSS Plugins (NullReceiver Supply Chain)** (`TL-2026-2547-SPL-001`)

Detects installation of npm packages known to carry the DPRK NullReceiver blockchain-C2 technique, distributed via typosquatted packages impersonating Tailwind CSS plugins (bianira-ui, fluid-type-ui, post-css-transfer, scrollbar-hide-plugin, tailwind-anim, tailwind-animation-founder, tailwindcss-anim) on developer workstations and CI/build hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1204.002
- **Data sources:** sysmon, edr_process_creation, npm_registry_audit_log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval cmd=lower(CommandLine)
| where match(Image, "(?i)npm(\.cmd)?$|node\.exe$|yarn(\.cmd)?$|pnpm(\.cmd)?$")
   AND match(cmd, "(?i)(bianira-ui|fluid-type-ui|post-css-transfer|scrollbar-hide-plugin|tailwind-anim|tailwind-animation-founder|tailwindcss-anim)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands by ComputerName, User, ParentImage
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("npm.cmd","npm","node.exe","yarn.cmd","pnpm.cmd")
| where ProcessCommandLine has_any ("bianira-ui","fluid-type-ui","post-css-transfer","scrollbar-hide-plugin","tailwind-anim","tailwind-animation-founder","tailwindcss-anim")
| project TimeGenerated=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| summarize count(), min(TimeGenerated), max(TimeGenerated) by DeviceName, AccountName, ProcessCommandLine
```

### Sigma

```yaml
title: Trojanized npm Package Install Impersonating Tailwind CSS Plugins (NullReceiver)
id: 7c1e2b9a-4f3d-4a6e-9b2d-1e6f8a2c5d31
status: experimental
description: Detects npm/yarn/pnpm installation of package names known to distribute the DPRK NullReceiver blockchain C2 technique via trojanized Tailwind CSS plugin impersonation.
references:
  - https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/17
tags:
  - attack.resource-development
  - attack.t1195.002
  - attack.t1204.002
  - attack.group.unc5342
  - attack.tool.nullreceiver
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\node.exe'
      - '\yarn.cmd'
      - '\pnpm.cmd'
  selection_pkg:
    CommandLine|contains:
      - 'bianira-ui'
      - 'fluid-type-ui'
      - 'post-css-transfer'
      - 'scrollbar-hide-plugin'
      - 'tailwind-anim'
      - 'tailwind-animation-founder'
      - 'tailwindcss-anim'
  condition: selection_proc and selection_pkg
falsepositives:
  - Internal package proxy/mirror pre-fetching a broad catalog of npm packages including these names for caching purposes
level: high
```

**Known false positives:**

- Internal artifact mirror or CI cache pre-fetching many npm packages including these exact typosquatted names for unrelated reasons

**Tuning notes:** Extend the package-name list as new NullReceiver/PolinRider typosquat variants are identified; correlate with subsequent outbound connections to non-standard ports or blockchain RPC endpoints (see TL-2026-2547-SPL-003) to raise confidence before paging.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Recruiter Interview Lure Leading to Execution of Unvetted Assessment Repository Code (locked: unlock with TL Creds)
- InvisibleFerret-style Host Enumeration Preceding Node/Python Remote Command Execution (locked: unlock with TL Creds)
- NullReceiver Zero-Value Ethereum Transaction Lookup Followed by C2 Callback (locked: unlock with TL Creds)
- JADESNOW-style JavaScript Downloader Invoking Blockchain eth_call Shortly After Install (locked: unlock with TL Creds)
- Suspicious ZIP Archive Creation of Browser/Wallet Artifacts by Script Interpreter (BeaverTail Staging) (locked: unlock with TL Creds)
- Exfiltration to Telegram or ErrTraffic Rotating C2 Domains and Community-Related Sibling Stealer Infrastructure (locked: unlock with TL Creds)
- BeaverTail-style Browser/Crypto-Wallet Credential Access from Non-Browser Process (locked: unlock with TL Creds)
- Outbound eth_call JSON-RPC to Public Blockchain Endpoints (EtherHiding Dead-Drop Lookup) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 29)

Defanged, TLP:CLEAR.

- IP address: `166.88.134[.]62`
- Domain: `bsc-testnet-rpc[.]publicnode[.]com`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Blockchain Dead Drops and EtherHiding](https://www.chainalysis.com/blog/etherhiding-blockchain-dead-drops/)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain](https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html)
- [Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet](https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html)
- [Smargaft harnesses EtherHiding for stealthy C2 hosting](https://blog.apnic.net/2024/04/01/smargaft-harnesses-etherhiding-for-stealthy-c2-hosting/)
- [Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign](https://thehackernews.com/2023/10/binances-smart-chain-exploited-in-new.html)
- [ErrTraffic Combines WordPress Hacks, Blockchain C2 and Rotating Malware Domains in One Delivery Network](https://gbhackers.com/errtraffic-combines-wordpress-hacks/)
- [NullReceiver Is Harder to Discover but Still Exposes a Reusable Attacker Wallet](https://gbhackers.com/nullreceiver-wallet-trail/)
- [ClearFake Malicious Framework Updates Tactics with Binance Smart Chain Obfuscation](https://rhisac.org/threat-intelligence/clearfake-malicious-framework-updates-tactics-with-binance-smart-chain-obfuscation/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2547