Top Highlights
- Cybercriminals, possibly linked to North Korea, are evolving blockchain-based command-and-control techniques by embedding C2 server IPs directly into Ethereum transaction addresses, making detection more difficult.
- The new "NullReceiver" method encodes C2 IPs within the recipient address of zero-value transactions, bypassing traditional detection methods that rely on monitoring fixed or payload-bearing addresses.
- This technique enables cheaper, harder-to-trace malware communications with no fixed target, significantly increasing operational resilience and complicating attribution efforts for defenders.
Threat, Attack Techniques, and Targets
Cybersecurity researchers have identified a new method used by threat actors to hide their command-and-control infrastructure. This method evolves from the EtherHiding tactic and is called NullReceiver. It is used in trojanized npm packages named “bianira-ui” and “fluid-type-ui.” These packages are no longer available but have been downloaded several hundred times since July 28, 2026. The activity has been linked to North Korea.
The technique involves embedding a C2 IP address inside the recipient address of an Ethereum transfer. Instead of using a fixed address or smart contracts, the malware reads the destination address of a zero-value transfer. It then decodes the IP address from the address bytes. This method makes it difficult for defenders to track the C2 server because there is no fixed destination address. The approach is more covert and less expensive than previous techniques.
Targets are not explicitly named, but the technique is designed to support malicious activities involving malware delivery and command execution. The method can be exploited by attackers using the trojanized npm packages and similar Ethereum transactions.
Impact, Security Implications, and Remediation Guidance
This new technique makes detection harder because there is no fixed transaction address or payload. It enhances operational resilience for threat actors, potentially allowing them to avoid detection and takedowns. The method also reduces the cost of using Ethereum transactions for C2 communication.
The impact on organizations is significant because it complicates efforts to detect and block malicious activity. Security teams should be aware of this evolving tactic. They need to monitor Ethereum transactions and analyze recipient addresses for unusual patterns.
Since specific remediation guidance is not provided, organizations should consult the relevant security vendors or authorities for advice. They should implement monitoring solutions that can detect unusual Ethereum transactions or suspicious use of npm packages. Additionally, staying informed about new threat techniques can help in developing effective defenses.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
