EtherHiding Tracker

Show 50 more

Newest C2 first; an address's page lists every host it served. A C2 date is when the host was written on-chain, and the host links to that transaction; "reported" marks a tie a cited report states without one. Non-C2 values are what the operator wrote that is not C2: a parked value is a well-known domain the resolver points at between sessions, while each real host stays minutes to hours. They are not indicators, and a download leaves them out unless asked. A host read on-chain since the last review is marked unreviewed until it is checked. "DPRK link unconfirmed" marks an address whose cited reporting does not tie it to North Korea; it may belong to another actor, and its page says why.

Other watchlist indicators

Show 50 more

The contracts and wallets are in the address table above. These are on-chain infrastructure, so the Remote Workers search does not reach them.

How EtherHiding works

A compromised page, trojanized package or fake coding assessment reads its next stage from a smart contract with a read-only eth_call. Removing the site or package leaves the contract in place, a new payload costs only a transaction fee, and the contract's history shows the writes but not the reads that delivered the payload.

Attribution

In October 2025 Google's Threat Intelligence Group reported the DPRK-linked actor UNC5342 using EtherHiding since about February 2025 in Contagious Interview, delivering JADESNOW, BEAVERTAIL and INVISIBLEFERRET (source 1); see the DPRK Repo Scanner. UNC5142 uses the method for crimeware without state attribution and is not listed (source 2).

Where the payload or C2 sits

• Contract state: the payload or a C2 URL sits in contract storage and is read back by a view method. EtherRAT's resolver contracts hold one C2 URL per operator wallet.
• Transaction calldata: GTIG lists transactions sent to the burn address carrying INVISIBLEFERRET payload; this site's enumeration of the sending wallet found ten, not three.
• No payload at all: NullReceiver (source 3) decodes its C2 IP from the recipient of a resolver wallet's latest zero-value transaction, so the address rotates; most of the resulting IPs appear in no published reporting.

The checker tool

The checker matches addresses against the watchlist and, given an RPC endpoint, reads each contract's data and C2 history without executing anything. A scheduled workflow opens a pull request when anything moves; output is on the results page.

Sources

1. Blas Kojusner, Robert Wallace, Joseph Dobson, "DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains," Mandiant / Google Threat Intelligence Group, October 16, 2025. cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding
2. "New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware," Google Cloud Blog (Mandiant Threat Defense / GTIG), October 16, 2025. Cited only to scope UNC5142 out of the attribution above. cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware
3. Paul McCarty, "NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding," OpenSourceMalware, August 2, 2026. Cited for the NullReceiver wallet, encoded destination and decoded C2 IP. opensourcemalware.com/blog/nullreceiver-dprk-c2-technique
4. "Simulating EtherHiding: Blockchain as a Malware," Cymulate. Cited for the eth_call retrieval mechanics, not for attribution. cymulate.com/blog/simulating-etherhiding-blockchain-as-a-malware