# North Korea-Linked XCTDH/OmniStealer Campaign Uses Ethereum Transactions (HashHiding) for Covert C2 Signaling

> DPRK-linked operators behind the Cross-Chain TxDataHiding (XCTDH) campaign encode the active C2 IPv4 address and port in the recipient address of ordinary Ethereum transfers ("HashHiding"), alongside TRON, Aptos and BNB Smart Chain layers that deliver encrypted JavaScript payloads. The DEV#POPPER.js Node.js RAT and the Python OmniStealer credential stealer are delivered to developers through fake job offers, trojanized GitHub repositories and npm packages on Windows, macOS and Linux.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2782
- **ID:** TL-2026-2782
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ransom-ISAC ("XCTDH Adopts Hash Hiding", September 2026) documents a DPRK-linked campaign first described in October 2025 as Cross-Chain TxDataHiding (XCTDH). The operators added an Ethereum-based recovery channel called HashHiding. Instead of storing payloads in smart contracts or transaction calldata (EtherHiding / TxDataHiding), the attacker's signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 sends mostly zero-value transfers whose recipient (`to`) address carries six bytes of data: the first 4 bytes are an IPv4 address and the next 2 bytes the port; further bytes carry a second IP/port pair (80) and padding. Ransom-ISAC observed 2,655 such beacon transactions between 2026-06-23 15:21 UTC and 2026-09-21 21:25 UTC (about one every 49-51 minutes, mostly 0 wei, some 150 wei) and four C2 rotations: 23.27.20.187:80, 23.27.20.187:443, 181.214.149.147:443 and 181.214.149.148:443. Most transfers move no cryptocurrency; a few send a tiny amount to an address whose private key nobody is expected to control. The technique closely resembles the "NullReceiver" dead-drop resolver that OpenSourceMalware disclosed in August 2026 in trojanized npm packages (bianira-ui, fluid-type-ui), which was also linked to the DPRK Contagious Interview activity.

Delivery targets developers. Victims receive fake job offers (Telegram-based), then run a trojanized GitHub repository or npm package, or a poisoned configuration file (e.g. config.js, tailwind.config.js) in which obfuscated JavaScript is appended after whitespace padding. The loader queries TRON wallets for the latest transaction, decodes a reversed BNB Smart Chain (BSC) transaction hash from it, and fetches an XOR-encrypted payload from BSC calldata; Aptos serves as a fallback pointer. Three channels run unconditionally in parallel: a hardcoded C2 IP (181.214.149.148:443 in the September chain), the TRON/Aptos-to-BSC XCTDH chain, and HashHiding on Ethereum. The C2 /init endpoint (443) returns a ~303KB JSON blob with `_B` (the DEV#POPPER.js RAT) and `_Z` (the HashHiding scanner, 69,470 characters obfuscated with base-91 using 18 custom alphabets plus generator-based control-flow flattening). `_Z` scans Ethereum mainnet at exponentially growing block offsets through public RPC providers (publicnode.com, drpc.org, blastapi.io), looks for transfers from the signal wallet, decodes the recipient address, fetches /boot (443) to load boot.js, then re-fetches /init and evals the RAT. A parallel path via /$/boot (80, XOR-encrypted dropper that installs Python 3.13 and 7-Zip) and /$/1 (80, OmniStealer) delivers the stealer.

DEV#POPPER.js is a cross-platform Node.js RAT (grown from ~530 lines in October 2025 to ~2,500 in September 2026) with WebSocket C2, shell command execution, keylogging and clipboard monitoring, and it persists by injecting into VSCode/Cursor and spawning the `_Z` module in every child process. OmniStealer is a ~3,500-line Python stealer targeting 153 cryptocurrency wallet targets plus browsers, password managers and cloud-storage credentials on Windows, macOS and Linux; it runs once (fire-and-forget), packs loot into an AES-encrypted ZIP and exfiltrates via the Telegram bot API. Campaign markers: `global.i = '5-3-132'`, `/*RS260605*/` (`_Z` version), OmniStealer build `B9=260924`, Node.js requests spoofing `Python-urllib/3.13`, and a custom `Sec-V` header. Attribution to North Korea rests on overlap with the Contagious Interview / Famous Chollima activity and on infrastructure continuity (the same BSC address and XOR key as the October 2025 chain); the report does not establish a victim count. Google GTIG's earlier reporting on UNC5342 (October 2025) describes related DPRK use of EtherHiding on BSC, and lists 0x9bc1355344b54dedf3e44296916ed15653844509 as the owner address of its BSC contract, which is the same address Ransom-ISAC lists as the BSC payload sender here.

## MITRE ATT&CK

- T1566.003 Spearphishing via Service
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.006 Python
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555.005 Password Managers
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1560.001 Archive via Utility
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service

## Sources

- [Hackers Turned Ethereum Into a Secret Messaging System for Malware](https://cybersecuritynews.com/ethereum-secret-messaging-system/)
- [XCTDH Adopts Hash Hiding (Ransom-ISAC)](https://ransom-isac.org/blog/xctdh-adopts-hash-hiding/)
- [DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware](https://gbhackers.com/hashhiding-to-blockchain-c2/)
- [XCTDH Campaign Uses HashHiding and Blockchain Transactions to Hide Malware C2 Infrastructure](https://cyberpress.org/xctdh-hides-malware-c2-on-blockchain/)
- [DPRK Adopts EtherHiding: Nation-State Threat Actors Increasingly Leveraging Blockchain (Google GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [North Korean hackers use EtherHiding to hide malware on the blockchain (BleepingComputer)](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [Trojanized npm packages decode C2 IP from Ethereum transfers (The Hacker News)](https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html)
- [Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Sonatype)](https://www.sonatype.com/blog/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads)
- [XCTDH research presented at BSidesLuxembourg 2026](https://pretalx.com/bsidesluxembourg-2026/talk/PHH3EJ)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2782