# Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)

> Netlas.io traces C2 evolution from IRC/HTTP to cloud and blockchain-based C2, where smart contracts resolve C2 addresses and resist takedown. Financially motivated UNC5142 (EtherHiding on ~14,000 compromised WordPress pages by June 2025), North Korean UNC5342 (multi-chain EtherHiding delivering JADESNOW and INVISIBLEFERRET) and commodity malware (Tsundere, SleepyDuck, SharkStealer) all use public blockchains as dead-drop resolvers.

- **Published:** 2026-11-03T09:20:45Z
- **Last reviewed:** 2026-11-03T09:20:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5137
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5137.png
- **ID:** TL-2026-5137
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNC5142 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

EtherHiding places malicious code or configuration inside smart contracts on public blockchains (BNB Smart Chain, Ethereum, BSC Testnet). Implants and injected web scripts retrieve it with read-only JSON-RPC eth_call requests, which cost nothing and blend with legitimate Web3 traffic. Because contract data is immutable and distributed, there is no single host to take down, and operators can rotate C2 addresses cheaply with a single transaction.

UNC5142 (tracked by Google Threat Intelligence Group since late 2023, financially motivated) injects JavaScript into vulnerable WordPress sites (plugin directories, theme files such as header.php/footer.php/index.php, and the database). The CLEARSHORT stage-1 script uses Web3.js against bsc-dataseed.binance.org to query a three-level Router-Logic-Storage contract chain, decrypts (AES-GCM from Dec 2024; Base64 before) a landing page and presents ClickFix lures (fake Chrome update, reCAPTCHA, Cloudflare 'Unusual Web Traffic', Anti-Bot). The victim is induced to paste a command into the Windows Run dialog, which fetches an HTA (often disguised as .xll) and a PowerShell loader that pulls an encrypted payload from GitHub or MediaFire and executes it in memory. Payloads observed: VIDAR, LUMMAC.V2, RADTHIEF and, for macOS, ATOMIC. GTIG assesses UNC5142 as a likely distribution-as-a-service cluster and does not attribute the payloads to it. Config updates cost roughly $0.25-$1.50. A main infrastructure set was deployed 2024-11-24 and a secondary set 2025-02-18; the last observed on-chain update was 2025-07-23. Infrastructure also abused Cloudflare Pages (40+ *.pages.dev domains).

UNC5342 (North Korea; overlaps the 'Contagious Interview' campaign) is the first nation-state actor GTIG observed using EtherHiding, active since February 2025. Fake recruiters on LinkedIn and job boards lure developers in the crypto and technology sectors into running coding assessments or malicious npm/GitHub packages, or fake browser-update prompts. The JADESNOW JavaScript downloader queries BNB Smart Chain and Ethereum for Base64/XOR-encoded payloads, then installs the INVISIBLEFERRET backdoor, which connects to C2 on port 3306 and steals wallet data (MetaMask, Phantom), browser credentials and password-manager data. GTIG measured 22+ contract updates over four months at about $1.37 each.

Commodity malware has adopted the same pattern. Tsundere (Kaspersky GReAT, Nov 2025) is an obfuscated Node.js botnet (ws, ethers, pm2) whose Ethereum contract stores the current WebSocket C2 in a setString() 'param1' variable; it uses AES-256-CBC C2 traffic, Run-key and pm2 persistence, avoids CIS locales and is attributed to a Russian-speaking actor 'koneko'. SleepyDuck (Open VSX extension juan-bianco.solidity-vlang v0.0.8, published 2025-11-01 after a benign v0.0.7 reached ~14,000 downloads) polls C2 sleepyduck.xyz every 30 seconds and falls back to an Ethereum contract via predefined RPC endpoints. SharkStealer is a Golang infostealer that resolves AES-CFB encrypted C2 addresses from BSC Testnet contracts with eth_call (selector 0x24c12bf6).

Defensive guidance in the source: restrict and monitor JSON-RPC egress (Infura, Alchemy, BSC dataseed) from non-Web3 hosts, alert on eth_call anomalies and non-browser processes talking to RPC endpoints, detect web3.js/ethers.js in unexpected places, hunt beaconing (30s intervals), JARM fingerprinting, certificate issuer DN pivots (e.g. O=Mythic), Server header 'AdaptixC2', and HTTP body-hash pivots. Severity HIGH is an analyst judgment; the source states no CVSS and no CVEs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1218.005 System Binary Proxy Execution: Mshta
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1082 System Information Discovery
- T1102.001 Web Service: Dead Drop Resolver
- T1568 Dynamic Resolution
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1583.006 Acquire Infrastructure: Web Services

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Run-Dialog PowerShell Loader - UNC5142 CLEARSHORT Exploitation Chain** (`TL-2026-5137-SPL-001`)

TL-2026-5137: UNC5142 injects CLEARSHORT JavaScript into compromised WordPress pages and shows ClickFix lures (fake Chrome update, reCAPTCHA, Cloudflare). The victim pastes a command into the Run dialog, so explorer.exe spawns PowerShell/cmd that fetches an HTA or an encrypted payload from GitHub or MediaFire (VIDAR, LUMMAC.V2, RADTHIEF). This rule flags that parent/child pair with download, encoded-command or known UNC5142 payload-host content (salorttactical.top, kimbeech.cfd, browser-storage.com).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.001, T1218.005, T1027
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe")
```UNC5142 CLEARSHORT ClickFix: a command pasted into the Windows Run dialog is launched directly by explorer.exe and pulls a loader```
| eval cmd=lower(CommandLine)
| where match(cmd, "(iex|invoke-expression|invoke-restmethod|invoke-webrequest|downloadstring|downloadfile|frombase64string|[ ;(]irm[ ]|[ ;(]iwr[ ]|-e(nc|ncodedcommand)?[ ]+[a-z0-9+/=]{40,}|mshta([.]exe)?[ ]+https?://|[.]xll|[.]hta|verify[.]sh|raw[.]githubusercontent[.]com|mediafire[.]com|salorttactical[.]top|kimbeech[.]cfd|browser-storage[.]com|discover-travel-agency[.]pro|ratatui[.]today)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as command_lines by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(?i)(iex|invoke-expression|invoke-restmethod|invoke-webrequest|downloadstring|downloadfile|frombase64string|[ ;(]irm[ ]|[ ;(]iwr[ ]|-e(nc|ncodedcommand)?[ ]+[a-z0-9+/=]{40,}|mshta([.]exe)?[ ]+https?://|[.]xll|[.]hta|verify[.]sh|raw[.]githubusercontent[.]com|mediafire[.]com|salorttactical[.]top|kimbeech[.]cfd|browser-storage[.]com|discover-travel-agency[.]pro|ratatui[.]today)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: ClickFix Run Dialog Launching Download Loader - UNC5142 CLEARSHORT
id: 5b1e7c2a-3d4f-4a6b-9c01-7a2e5d8f1b11
status: experimental
description: Detects explorer.exe directly spawning PowerShell or cmd with a download-and-execute, encoded or known UNC5142 payload-host command line, the Run-dialog paste step of CLEARSHORT ClickFix lures.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.t1218.005
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
    selection_cmd:
        CommandLine|contains:
            - 'iex '
            - 'iex('
            - 'Invoke-Expression'
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - 'DownloadString'
            - 'DownloadFile'
            - 'FromBase64String'
            - ' -enc '
            - ' -EncodedCommand'
            - 'mshta http'
            - '.xll'
            - '.hta'
            - 'verify.sh'
            - 'raw.githubusercontent.com'
            - 'mediafire.com'
            - 'salorttactical.top'
            - 'kimbeech.cfd'
            - 'browser-storage.com'
            - 'discover-travel-agency.pro'
            - 'ratatui.today'
    condition: selection_parent and selection_img and selection_cmd
falsepositives:
    - Administrators or help-desk staff pasting an install one-liner into the Run dialog
    - Software installers that start PowerShell from Explorer with encoded arguments
level: high

```

**Known false positives:**

- Administrators or help-desk staff pasting an install one-liner into the Run dialog
- Software installers that launch PowerShell from Explorer with encoded arguments

**Tuning notes:** Add the approved internal deployment hosts and admin accounts to an exclusion lookup. Raise the base64 length threshold if installers trigger it. Enable Windows 4688 command-line auditing or Sysmon EventCode 1 so CommandLine is populated. Extend the host list with new payload domains as UNC5142 rotates infrastructure.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- UNC5142 CLEARSHORT Infrastructure and Browser-to-BSC RPC Lookup - Compromised WordPress Exploitation (locked: unlock with TL Creds)
- Browser Credential and Crypto-Wallet Store Access by Non-Browser Process - Infostealer Post-Exploitation (locked: unlock with TL Creds)
- Known EtherHiding-Malware C2 and INVISIBLEFERRET Port 3306 Egress (locked: unlock with TL Creds)
- Mshta Remote HTA / XLL-Disguised HTA Execution - UNC5142 ClickFix Stage 2 (locked: unlock with TL Creds)
- SleepyDuck Malicious VS Code / Open VSX Extension - Supply Chain Execution and C2 (locked: unlock with TL Creds)
- Known EtherHiding Contract Address and eth_call Selector - Dead-Drop Resolver (locked: unlock with TL Creds)
- Node.js/pm2 Run-Key Persistence - Tsundere Botnet Post-Exploitation (locked: unlock with TL Creds)
- Non-Browser Process to Blockchain RPC Endpoint - EtherHiding C2 Resolution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `84.54.44[.]48`
- Domain: `securemetricsapi[.]live`
- File hash: `3d54cbbab911d09ecaec19acb292e476b0073d14e227d79919740511109d9274`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Evolution of C2: Centralized to On-Chain (Netlas.io, Sukant Kumar)](https://netlas.io/blog/evolution_of_c2_infrastructure/)
- [New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware (Google Cloud / GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware)
- [DPRK Adopts EtherHiding for Nation-State Operations (Google Cloud / GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [Tsundere: Node.js botnet uses Ethereum blockchain (Kaspersky GReAT / Securelist)](https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/)
- [Malicious VSX Extension SleepyDuck Uses Ethereum for C2 (The Hacker News)](https://thehackernews.com/2025/11/malicious-vsx-extension-sleepyduck-uses.html)
- [Fake Solidity VSCode extension on Open VSX backdoors developers (BleepingComputer)](https://bleepingcomputer.com/news/security/fake-solidity-vscode-extension-on-open-vsx-backdoors-developers)
- [SleepyDuck malware in Open VSX extensions (Pluto Security)](https://pluto.security/blog/sleepyduck-malware-open-vsx-extensions/)
- [SharkStealer Using EtherHiding Pattern to Resolve Communications With C2 Channels (Cyber Security News, VMRay analysis)](https://cybersecuritynews.com/sharkstealer-using-etherhiding-pattern/amp)
- [Tsundere Botnet Expands Using Game Lures (The Hacker News)](https://thehackernews.com/2025/11/tsundere-botnet-expands-using-game.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5137