Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)

Key facts for TL-2026-5137

Detection coverage for TL-2026-5137

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5137 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Run-Dialog PowerShell Loader - UNC5142 CLEARSHORT Exploitation Chain

TL-2026-5137: UNC5142 injects CLEARSHORT JavaScript into compromised WordPress pages and shows ClickFix lures (fake Chrome update, reCAPTCHA, Cloudflare). The victim pastes a command into the Run dialog, so explorer.exe spawns PowerShell/cmd that fetches an HTA or an encrypted payload from GitHub or MediaFire (VIDAR, LUMMAC.V2, RADTHIEF). This rule flags that parent/child pair with download, encoded-command or known UNC5142 payload-host content (salorttactical.top, kimbeech.cfd, browser-storage.com).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.001, T1218.005, T1027
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe")
```UNC5142 CLEARSHORT ClickFix: a command pasted into the Windows Run dialog is launched directly by explorer.exe and pulls a loader```
| eval cmd=lower(CommandLine)
| where match(cmd, "(iex|invoke-expression|invoke-restmethod|invoke-webrequest|downloadstring|downloadfile|frombase64string|[ ;(]irm[ ]|[ ;(]iwr[ ]|-e(nc|ncodedcommand)?[ ]+[a-z0-9+/=]{40,}|mshta([.]exe)?[ ]+https?://|[.]xll|[.]hta|verify[.]sh|raw[.]githubusercontent[.]com|mediafire[.]com|salorttactical[.]top|kimbeech[.]cfd|browser-storage[.]com|discover-travel-agency[.]pro|ratatui[.]today)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as command_lines by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(?i)(iex|invoke-expression|invoke-restmethod|invoke-webrequest|downloadstring|downloadfile|frombase64string|[ ;(]irm[ ]|[ ;(]iwr[ ]|-e(nc|ncodedcommand)?[ ]+[a-z0-9+/=]{40,}|mshta([.]exe)?[ ]+https?://|[.]xll|[.]hta|verify[.]sh|raw[.]githubusercontent[.]com|mediafire[.]com|salorttactical[.]top|kimbeech[.]cfd|browser-storage[.]com|discover-travel-agency[.]pro|ratatui[.]today)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: ClickFix Run Dialog Launching Download Loader - UNC5142 CLEARSHORT
id: 5b1e7c2a-3d4f-4a6b-9c01-7a2e5d8f1b11
status: experimental
description: Detects explorer.exe directly spawning PowerShell or cmd with a download-and-execute, encoded or known UNC5142 payload-host command line, the Run-dialog paste step of CLEARSHORT ClickFix lures.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.t1218.005
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
    selection_cmd:
        CommandLine|contains:
            - 'iex '
            - 'iex('
            - 'Invoke-Expression'
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - 'DownloadString'
            - 'DownloadFile'
            - 'FromBase64String'
            - ' -enc '
            - ' -EncodedCommand'
            - 'mshta http'
            - '.xll'
            - '.hta'
            - 'verify.sh'
            - 'raw.githubusercontent.com'
            - 'mediafire.com'
            - 'salorttactical.top'
            - 'kimbeech.cfd'
            - 'browser-storage.com'
            - 'discover-travel-agency.pro'
            - 'ratatui.today'
    condition: selection_parent and selection_img and selection_cmd
falsepositives:
    - Administrators or help-desk staff pasting an install one-liner into the Run dialog
    - Software installers that start PowerShell from Explorer with encoded arguments
level: high

Known false positives:

• Administrators or help-desk staff pasting an install one-liner into the Run dialog
• Software installers that launch PowerShell from Explorer with encoded arguments

Tuning notes: Add the approved internal deployment hosts and admin accounts to an exclusion lookup. Raise the base64 length threshold if installers trigger it. Enable Windows 4688 command-line auditing or Sysmon EventCode 1 so CommandLine is populated. Extend the host list with new payload domains as UNC5142 rotates infrastructure.

• 🔒 UNC5142 CLEARSHORT Infrastructure and Browser-to-BSC RPC Lookup - Compromised WordPress Exploitation · unlock with TL Creds
• 🔒 Browser Credential and Crypto-Wallet Store Access by Non-Browser Process - Infostealer Post-Exploitation · unlock with TL Creds
• 🔒 Known EtherHiding-Malware C2 and INVISIBLEFERRET Port 3306 Egress · unlock with TL Creds
• 🔒 Mshta Remote HTA / XLL-Disguised HTA Execution - UNC5142 ClickFix Stage 2 · unlock with TL Creds
• 🔒 SleepyDuck Malicious VS Code / Open VSX Extension - Supply Chain Execution and C2 · unlock with TL Creds
• 🔒 Known EtherHiding Contract Address and eth_call Selector - Dead-Drop Resolver · unlock with TL Creds
• 🔒 Node.js/pm2 Run-Key Persistence - Tsundere Botnet Post-Exploitation · unlock with TL Creds
• 🔒 Non-Browser Process to Blockchain RPC Endpoint - EtherHiding C2 Resolution · unlock with TL Creds

Indicators of compromise for TL-2026-5137

As of 2026-11-03, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5137.

Sample indicators (3 of 30)

• IP address: 84.54.44[.]48
• Domain: securemetricsapi[.]live
• File hash: 3d54cbbab911d09ecaec19acb292e476b0073d14e227d79919740511109d9274

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How Evolution of C2 Infrastructure works

EtherHiding places malicious code or configuration inside smart contracts on public blockchains (BNB Smart Chain, Ethereum, BSC Testnet). Implants and injected web scripts retrieve it with read-only JSON-RPC eth_call requests, which cost nothing and blend with legitimate Web3 traffic. Because contract data is immutable and distributed, there is no single host to take down, and operators can rotate C2 addresses cheaply with a single transaction.

UNC5142 (tracked by Google Threat Intelligence Group since late 2023, financially motivated) injects JavaScript into vulnerable WordPress sites (plugin directories, theme files such as header.php/footer.php/index.php, and the database). The CLEARSHORT stage-1 script uses Web3.js against bsc-dataseed.binance.org to query a three-level Router-Logic-Storage contract chain, decrypts (AES-GCM from Dec 2024; Base64 before) a landing page and presents ClickFix lures (fake Chrome update, reCAPTCHA, Cloudflare 'Unusual Web Traffic', Anti-Bot). The victim is induced to paste a command into the Windows Run dialog, which fetches an HTA (often disguised as .xll) and a PowerShell loader that pulls an encrypted payload from GitHub or MediaFire and executes it in memory. Payloads observed: VIDAR, LUMMAC.V2, RADTHIEF and, for macOS, ATOMIC. GTIG assesses UNC5142 as a likely distribution-as-a-service cluster and does not attribute the payloads to it. Config updates cost roughly $0.25-$1.50. A main infrastructure set was deployed 2024-11-24 and a secondary set 2025-02-18; the last observed on-chain update was 2025-07-23. Infrastructure also abused Cloudflare Pages (40+ *.pages.dev domains).

UNC5342 (North Korea; overlaps the 'Contagious Interview' campaign) is the first nation-state actor GTIG observed using EtherHiding, active since February 2025. Fake recruiters on LinkedIn and job boards lure developers in the crypto and technology sectors into running coding assessments or malicious npm/GitHub packages, or fake browser-update prompts. The JADESNOW JavaScript downloader queries BNB Smart Chain and Ethereum for Base64/XOR-encoded payloads, then installs the INVISIBLEFERRET backdoor, which connects to C2 on port 3306 and steals wallet data (MetaMask, Phantom), browser credentials and password-manager data. GTIG measured 22+ contract updates over four months at about $1.37 each.

Commodity malware has adopted the same pattern. Tsundere (Kaspersky GReAT, Nov 2025) is an obfuscated Node.js botnet (ws, ethers, pm2) whose Ethereum contract stores the current WebSocket C2 in a setString() 'param1' variable; it uses AES-256-CBC C2 traffic, Run-key and pm2 persistence, avoids CIS locales and is attributed to a Russian-speaking actor 'koneko'. SleepyDuck (Open VSX extension juan-bianco.solidity-vlang v0.0.8, published 2025-11-01 after a benign v0.0.7 reached ~14,000 downloads) polls C2 sleepyduck.xyz every 30 seconds and falls back to an Ethereum contract via predefined RPC endpoints. SharkStealer is a Golang infostealer that resolves AES-CFB encrypted C2 addresses from BSC Testnet contracts with eth_call (selector 0x24c12bf6).

Defensive guidance in the source: restrict and monitor JSON-RPC egress (Infura, Alchemy, BSC dataseed) from non-Web3 hosts, alert on eth_call anomalies and non-browser processes talking to RPC endpoints, detect web3.js/ethers.js in unexpected places, hunt beaconing (30s intervals), JARM fingerprinting, certificate issuer DN pivots (e.g. O=Mythic), Server header 'AdaptixC2', and HTTP body-hash pivots. Severity HIGH is an analyst judgment; the source states no CVSS and no CVEs.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1218.005 System Binary Proxy Execution: Mshta; T1497 Virtualization/Sandbox Evasion

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1568 Dynamic Resolution; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Resource Development

T1583.006 Acquire Infrastructure: Web Services

Remediation for Evolution of C2 Infrastructure

Patches

• Keep WordPress core, themes and plugins updated to remove the initial injection vector
• Remove malicious VS Code/Open VSX extensions (juan-bianco.solidity-vlang and the listed developmentinc.* extensions)

Immediate actions

• Block or alert on JSON-RPC egress (eth_call) to Ethereum/BSC RPC providers such as bsc-dataseed.binance.org, *.infura.io, *.alchemyapi.io and data-seed-prebsc-2-s1.binance.org from hosts with no Web3 business need
• Block listed C2 domains and IPs and hunt for the listed contract addresses in proxy, DNS and EDR telemetry
• Alert on non-browser processes (node.exe, powershell.exe, mshta.exe, Go binaries) connecting to blockchain RPC endpoints
• Alert on outbound port 3306 to non-database destinations (INVISIBLEFERRET C2)
• Audit WordPress sites for injected JavaScript in theme files (header.php, footer.php, index.php), plugins and the database

Workarounds

• Restrict Run-dialog paste-and-execute behaviour via application control and PowerShell constrained language mode
• Allow-list extensions and npm packages in developer environments

Longer-term hardening

• Deploy EDR with behavioral detection for Run-dialog ClickFix execution chains (explorer -> powershell/mshta)
• Hunt for Web3 libraries (web3.js, ethers.js) and Node.js runtimes under %APPDATA%\Local\nodejs
• Use JARM fingerprinting, certificate issuer DN pivots and HTTP header/body-hash pivots to find framework C2 (Mythic, AdaptixC2)
• Enforce Chrome Enterprise policies (DownloadRestrictions, managed updates, URLBlocklist, Safe Browsing enhanced) and train developers on fake-recruiter lures

Affected and fixed versions

• WordPress (third-party sites) — Compromised WordPress installations
  Vulnerable versions: Unpatched/vulnerable installations (unspecified)
• Microsoft — Windows (ClickFix, Tsundere, SharkStealer targets)
  Vulnerable versions: Windows endpoints
• Apple — macOS (ATOMIC stealer lures)
  Vulnerable versions: macOS endpoints
• Open VSX / VS Code Marketplace — Malicious editor extensions (SleepyDuck)
  Vulnerable versions: juan-bianco.solidity-vlang 0.0.8

Timeline of Evolution of C2 Infrastructure

• 2024-11-24 UNC5142 deploys its main three-level (Router-Logic-Storage) smart contract infrastructure on BNB Smart Chain; updated monthly/bi-weekly through May 2025.
• 2025-02-18 UNC5142 deploys a secondary parallel contract infrastructure, active mainly Feb-March 2025.
• 2025-06-01 By June 2025 GTIG identifies ~14,000 compromised web pages hosting UNC5142 EtherHiding injection code (month-level date from source).
• 2025-07-23 Last observed on-chain contract update by UNC5142, suggesting a pause or shift in TTPs.
• 2025-08-19 Tsundere C2 locked-ioc-19:1234 first seen; other Tsundere C2 nodes seen from May to August 2025.
• 2025-10-31 SleepyDuck Ethereum contract created and benign extension juan-bianco.solidity-vlang v0.0.7 published to Open VSX.
• 2025-11-01 Malicious v0.0.8 of juan-bianco.solidity-vlang published after ~14,000 downloads; C2 config switched to locked-ioc-18 via contract transactions.
• 2025-12-12 Netlas.io publishes analysis of the evolution of C2 infrastructure to on-chain C2, with hunting guidance.

Sources cited for Evolution of C2 Infrastructure

• New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware (Google Cloud / GTIG) Google Cloud · Vendor report
• DPRK Adopts EtherHiding for Nation-State Operations (Google Cloud / GTIG) Google Cloud · Vendor report
• Tsundere: Node.js botnet uses Ethereum blockchain (Kaspersky GReAT / Securelist) Kaspersky Securelist · Research
• SleepyDuck malware in Open VSX extensions (Pluto Security) pluto.security · Research
• The Evolution of C2: Centralized to On-Chain (Netlas.io, Sukant Kumar) netlas.io · Blog · 2025-12-12
• Malicious VSX Extension SleepyDuck Uses Ethereum for C2 (The Hacker News) The Hacker News · News · 2025-11-01
• Fake Solidity VSCode extension on Open VSX backdoors developers (BleepingComputer) BleepingComputer · News
• SharkStealer Using EtherHiding Pattern to Resolve Communications With C2 Channels (Cyber Security News, VMRay analysis) cybersecuritynews.com · News
• Tsundere Botnet Expands Using Game Lures (The Hacker News) The Hacker News · News · 2025-11-01

More in malware

• ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware
• SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft
• Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity