EtherHiding
EtherHiding is a blockchain-based malware hosting and command-and-control technique in which malicious JavaScript, payloads, configuration data, or C2 endpoints are embedded in public blockchain smart contracts rather than hosted solely on traditional servers. Reported implementations use Ethereum, BNB Smart Chain, Polygon, Avalanche, and BNB Smart Chain TestNet, with malware retrieving data through public RPC endpoints and smart-contract read calls such as getURL(), ERC20 name(), or similar lookups. The technique is designed to make attacker infrastructure resilient to takedown because smart contracts are decentralized and effectively immutable, while allowing operators to rotate payloads or C2 information cheaply through blockchain updates.
The content links EtherHiding to multiple campaigns and malware chains. Google Threat Intelligence Group reported North Korea-aligned UNC5342 using EtherHiding in the Contagious Interview social-engineering campaign targeting developers and cryptocurrency firms, including delivery chains involving JadeSnow and InvisibleFerret. In that reporting, malicious files or JavaScript retrieved crypto-stealing malware or C2 information from Ethereum and BNB Smart Chain smart contracts. Similar blockchain-based staging was also described in financially motivated WordPress compromise activity associated with UNC5142/ClearFake-style infrastructure, where injected JavaScript downloaders used BNB Smart Chain smart contracts as a control layer to distribute infostealers such as Vidar, Lummac.V2, and RadThief. Additional observed uses include ErrTraffic V3 ClickFix campaigns against compromised WordPress sites, where injected JavaScript queried Polygon smart contracts to retrieve attacker-controlled infrastructure; OCRFix, which used BNB Smart Chain TestNet smart contracts to obtain C2 addresses after fake CAPTCHA/PowerShell social engineering; a 10-stage Windows intrusion chain culminating in the HellsUchecker backdoor, where a 6.5 MB .NET EtherHiding loader queried BNB Smart Chain and Avalanche for encrypted JSON C2 configuration; Kimwolf Android botnet variants that incorporated EtherHiding/blockchain domains for resilience; and the GlassWorm loader delivered through malicious Open VSX extension updates, where EtherHiding was used to fetch C2 endpoints.
Across the cited reporting, EtherHiding-enabled malware supports retrieval of hidden payloads or C2 endpoints, host fingerprinting, system-information collection, credential theft, cryptocurrency theft, exfiltration, persistence, and follow-on payload delivery depending on the surrounding malware family. Infection vectors mentioned in the content include fake job offers and technical assessments, compromised WordPress sites, ClickFix/fake CAPTCHA lures, SEO poisoning, typosquatting, malicious MSI installers, and poisoned software-extension updates. High-confidence observables directly mentioned include the Polygon wallet address 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 used by ErrTraffic, smart-contract function selector 0x38bcdc1c corresponding to getURL(), the HellsUchecker-related smart-contract address 0x328A1faDff154290F0Ce1389a4E633698CDfdAa7 using selector 0x06fdde03, and infrastructure such as more-arpc.icu, rpcsecnoweb.pro, rec.allthe.site/chk, opsecdefcloud[.]com, ldture[.]com, and bsc-testnet.publicnode[.]com in specific campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GTIG said it observed UNC5342 using EtherHiding, malicious code in the form of JavaScript payloads that turn a public blockchain into a decentralized command and control server.
Google researchers revealed that North Korean hackers have been using a technique known as “EtherHiding” to host their malware, storing their malicious code in a smart contract on Ethereum’s blockchain... the file pulls down crypto-stealing malware hosted on Ethereum’s blockchain.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A technique/loader that leverages blockchain smart contracts and RPC endpoints to host or retrieve malicious code or configuration data, hiding attacker-controlled URLs and payload staging behind decentralized infrastructure.
.NET loader/C2-hiding technique that retrieves encrypted C2 configuration from blockchain smart contracts (BSC/Avalanche) and then fetches additional stage payloads from the decoded C2 hosts.
Technique/mechanism used by malware to retrieve/resolve command-and-control server details and support follow-on communications.
Technique/tooling referenced as 'EtherHiding' used by malware to obtain/resolve its C2 server and communicate system information while awaiting commands.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.