North Korean Hackers Use Empty Crypto Transfers to Hide Malware Servers

Key Takeaways

• North Korean-linked threat actors are employing a novel technique called “NullReceiver” to conceal malware command-and-control (C2) server addresses within empty Ethereum transactions.
• This method makes C2 communications appear as legitimate cryptocurrency transfers, effectively evading traditional security detection mechanisms.
• The attack was discovered in two malicious npm packages, bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8, impersonating legitimate Tailwind CSS plugins.
• The technique poses a significant supply-chain risk, as developers unknowingly installing these packages could compromise their systems.
• No direct fix for NullReceiver itself is available, but proactive monitoring and supply chain security measures can mitigate the risk.

North Korean Hackers Adopt Novel C2 Hiding Technique Using Empty Crypto Transfers

A sophisticated new method for obscuring malware command-and-control (C2) infrastructure has been uncovered, linked to North Korean state-sponsored hacking groups. This innovative technique, dubbed “NullReceiver,” embeds C2 server addresses within the recipient fields of empty Ethereum transactions, masquerading malicious communications as ordinary blockchain activity.

This approach leverages the decentralized and immutable nature of public blockchains to provide a resilient and stealthy C2 mechanism, making it significantly harder for cybersecurity defenses to detect and disrupt. The full details of this discovery are outlined in a report from OpenSource Malware.

How NullReceiver Works

The NullReceiver technique operates by encoding the C2 server’s IP address directly into the recipient address of an Ethereum transaction. Crucially, these transactions are “empty” – they carry no monetary value and contain no input data, smart contract calls, or hidden scripts. This lack of observable malicious content allows them to blend seamlessly with legitimate blockchain traffic, making them exceptionally difficult for security tools to flag.

When a compromised system needs to retrieve C2 instructions, it queries a public Ethereum Remote Procedure Call (RPC) service. It then identifies the latest outgoing transaction from a pre-determined attacker-controlled Ethereum wallet (e.g., 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a). The malware extracts the recipient address (such as 0xa658863ea658863e68656c6c6f6970626f742121) and decodes a specific portion of its bytes to reveal the IP address of the next-stage C2 server (e.g., 166.88.134.62). This C2 IP can then direct the infected system to further malicious operations via endpoints like 166.88.134.62:443 or 166.88.134.62:80.

This method represents an evolution from previously observed blockchain-based C2 techniques, such as EtherHiding, which typically store command data in a transaction’s calldata or within a smart contract. While NullReceiver can only transmit limited information, like an IP address, it offers a more cost-effective and less conspicuous alternative. It also avoids the predictable destination addresses that defenders might monitor with EtherHiding, as OpenSource Malware said in a report shared with Cyber Security News (CSN).

Discovered in Malicious npm Packages

Researchers identified the NullReceiver technique within two malicious npm packages: bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8. These packages were designed to mimic legitimate Tailwind CSS plugins, creating a significant software supply-chain threat. Developers who integrated these dependencies into their projects without rigorous code review inadvertently exposed their systems to this sophisticated C2 mechanism. The campaign is believed to be connected to the DPRK-linked “Contagious Interview” operation, known for targeting developers through seemingly innocuous projects.

The analysis, conducted through static code review and read-only blockchain queries, revealed that the malicious packages utilized Node.js code to interact with public Ethereum RPC services, including https://1rpc.io/eth and https://eth.drpc.org. This code was responsible for fetching the latest transaction from the attacker’s wallet, decoding the embedded C2 IP, and establishing contact with the newly identified server.

Supply Chain Risks Grow

The emergence of NullReceiver underscores the increasing sophistication of software supply-chain attacks. Unlike traditional C2 servers that can be identified and blocked, blockchain-based infrastructure offers attackers a highly resilient and difficult-to-dismantle command channel. This decentralization ensures that even if specific C2 endpoints are taken offline, the malware can dynamically discover new ones by querying the blockchain.

The threat to developers is particularly acute, as malicious npm dependencies can infiltrate development environments, build pipelines, and production systems through routine installation commands. Previous incidents, such as large-scale npm package compromises, have demonstrated how stolen developer credentials and cloud access can rapidly escalate a supply-chain incident, affecting numerous projects and organizations. North Korean threat actors continue to prioritize convincing software lures, often leveraging social engineering alongside technical exploits.

What You Should Do

• Strengthen Software Supply Chain Security: Implement strict policies for reviewing and validating all third-party dependencies before integration into projects. Utilize tools for static and dynamic analysis of packages to detect suspicious behavior.
• Monitor Outbound Network Traffic: Specifically look for unusual or unexpected outbound traffic to cryptocurrency RPC providers (e.g., Ethereum RPC URLs) from development or production systems.
• Isolate Compromised Systems: Immediately isolate any machines found to have installed the identified malicious packages ([email protected] and [email protected]).
• Rotate Credentials: Promptly rotate any developer or cloud credentials that may have been exposed on systems where these packages were installed.
• Blockchain Monitoring: For security teams with blockchain analysis capabilities, monitor the specified attacker-controlled Ethereum wallet (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a) for new outgoing transactions. This can help identify newly encoded C2 infrastructure before compromised systems connect.
• Restrict RPC Access: Limit unnecessary access to cryptocurrency RPC services from internal networks and critical infrastructure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.