Loading story…
Threat actors are increasingly using blockchain dead drops—public-chain transactions and smart contracts that store payload locations, command-and-control (C2) settings, or infrastructure pointers—to make malware operations harder to disrupt. Chainalysis reported that state-linked operators accounted for about two-thirds of newly observed activity per quarter by Q2 2026. The technique does not inherently improve malware capabilities, but lets operators retain C2 coordination after defenders remove domains, hosting, or code repositories.
Reported campaigns include DPRK-linked UNC5342, which used a redundant TRON, Aptos, and Binance Smart Chain relay during fraudulent cryptocurrency-developer job interviews designed to steal credentials; suspected Iranian Ministry of Intelligence-linked operators embedding C2 data in Bitcoin transactions; and Russian-language criminal sellers offering Polygon-based dead-drop infrastructure as malware-as-a-service. EtherHiding has also been associated with web-based malware delivery such as ClearFake and ClickFix activity. Defenders should add endpoint and blockchain telemetry, particularly outbound JSON-RPC requests to public blockchain nodes, rather than indiscriminately blocking all blockchain traffic.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
DPRK-linked UNC5342 began using public-blockchain smart contracts to deliver malware to cryptocurrency developers targeted through fraudulent recruiter and job-interview lures.
Suspected Iranian Ministry of Intelligence-linked operators began embedding encoded C2 routing data in Bitcoin transactions, including small payments sent to an address historically associated with Satoshi Nakamoto.
The Smargaft DDoS botnet used smart-contract-based command-and-control infrastructure hosted on Binance Smart Chain.
After Cloudflare disrupted servers used to deliver its infostealing malware, ClearFake operators adopted EtherHiding on Binance Smart Chain.
Glupteba operators stored malicious information in Bitcoin OP_RETURN fields as part of blockchain-based infrastructure use.
Cybercriminals encoded command-and-control IP addresses for banking malware in Bitcoin transaction amounts denominated in Satoshis.
A Necurs botnet variant used Namecoin to store command-and-control domain information, representing the earliest cited blockchain dead-drop example.
Russian-language cybercriminal operators used Polygon smart contracts as command-and-control dead-drop resolvers in a reported malware-as-a-service operation with an operator panel and subscription model.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcechainalysis.com
Open sourcecertego.net
Open sourcermceoin.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers have adopted a novel technique called EtherHiding, which leverages public blockchain networks to conceal and control malware, making their operations highly resistant to takedown efforts. According to research from Google’s Threat Intelligence Group, at least two distinct hacking groups are utilizing this method: one is a North Korean state-sponsored actor, tracked as UNC5342, and the other is a financially motivated cybercriminal group, UNC5142. EtherHiding works by embedding malicious instructions within blockchain smart contracts, rather than relying on traditional command-and-control servers. This approach exploits the decentralized and immutable nature of blockchains, providing attackers with a resilient infrastructure that is difficult for law enforcement or defenders to disrupt. The North Korean group UNC5342 has used EtherHiding in social engineering campaigns targeting developers and cryptocurrency firms, often luring victims with job-related files or coding challenges. When a target opens a malicious file, a script connects to the blockchain to retrieve encrypted code from a smart contract, which then installs the JadeSnow loader. This loader subsequently delivers a persistent backdoor known as InvisibleFerret, which has been linked to multiple cryptocurrency thefts. Meanwhile, the financially motivated group UNC5142 has adapted EtherHiding to distribute infostealers via compromised WordPress sites. The technique allows attackers to update or replace their malware by simply modifying the smart contract, further complicating detection and remediation. Researchers note that this represents a significant escalation in the threat landscape, as blockchain’s pseudonymous and decentralized features provide a form of "bulletproof" hosting for malicious operations. EtherHiding was first observed in 2023 in a campaign called ClearFake, but its adoption by nation-state actors marks a new phase in cybercriminal innovation. The use of blockchain for malware delivery not only hinders traditional takedown strategies but also enables attackers to operate with greater anonymity. Security experts warn that this method can be easily adapted for new campaigns, increasing the risk to organizations in the cryptocurrency and technology sectors. The persistence and flexibility of blockchain-hosted malware pose a growing challenge for defenders, who must now contend with threats that cannot be neutralized by simply removing malicious servers. This development underscores the need for enhanced monitoring of blockchain activity and improved detection mechanisms for malware leveraging decentralized technologies. Organizations are advised to educate employees about social engineering tactics and to implement robust endpoint security to mitigate the risks associated with these advanced attack techniques.
Jun 29, 2026
Google Cloud's Mandiant reported that North Korean operators adopted **EtherHiding**, a technique that abuses blockchain infrastructure to hide malicious content and stage malware delivery. The activity uses decentralized platforms to store or retrieve attacker-controlled data, complicating takedown efforts and making network-based detection harder because the infrastructure blends into legitimate blockchain traffic. The report links the tradecraft to DPRK threat activity and highlights a broader shift toward resilient, hard-to-disrupt hosting for command-and-control or payload staging. By moving parts of the infection chain onto blockchain-backed services, the operators reduce reliance on traditional attacker domains and hosting, increasing the durability and stealth of malware campaigns targeting victims across the internet.
Jun 29, 2026
North Korean state-sponsored hackers have adopted a novel technique known as EtherHiding to distribute malware and facilitate cryptocurrency theft. The Google Threat Intelligence Group (GTIG) has attributed this activity to a threat actor tracked as UNC5342, which is also known by several other names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, and Void Dokkaebi. This marks the first documented instance of a state-backed hacking group leveraging EtherHiding, a method previously described by Guardio Labs in 2023. EtherHiding involves embedding malicious payloads within smart contracts on public blockchains such as Ethereum and Binance Smart Chain (BSC), allowing attackers to host and update malware in a manner that is highly resistant to takedown and difficult to trace. The campaign, codenamed Contagious Interview, targets software and web developers through social engineering, often beginning with fake job offers on LinkedIn. Attackers impersonate recruiters or hiring managers from fabricated entities like BlockNovas LLC, Angeloper Agency, and SoftGlide LLC, and eventually move conversations to platforms like Telegram or Discord. Victims are tricked into running code as part of a technical assessment, which executes a JavaScript downloader. This downloader, known as JADESNOW, interacts with the blockchain to fetch a third-stage payload, typically a JavaScript version of the InvisibleFerret malware, which is designed for long-term espionage. The payload runs in memory and may request additional components from the blockchain, such as credential stealers. The use of smart contracts for payload delivery provides anonymity, flexibility for updating malicious code, and evasion of traditional detection and takedown mechanisms. The attackers' ability to retrieve payloads from either Ethereum or BSC further complicates analysis and defense. The campaign's objectives align with North Korea's dual goals of cyber espionage and financial gain, as the malware is used to steal sensitive data and siphon cryptocurrency assets from compromised developers. The cost to update the malicious payload is minimal, averaging around $1.37 in gas fees, making the technique both economical and scalable for the threat actors. The use of read-only calls to fetch payloads leaves no visible transaction history, enhancing the stealth of the operation. This development represents a significant evolution in the tactics of North Korean cyber operations, demonstrating their increasing sophistication and willingness to exploit decentralized technologies for malicious purposes. Security researchers warn that the resilience and anonymity provided by blockchain-based malware delivery could inspire similar tactics among other threat actors. Organizations are advised to increase vigilance, especially when dealing with unsolicited job offers and technical assessments that require code execution. The campaign underscores the importance of robust security awareness training and technical controls to detect and prevent such advanced social engineering and malware delivery techniques.
Jun 29, 2026