Chollima Hunter

← EtherHiding Tracker

publisherresolution.com

publisherresolution.com is a domain that 3 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), Sysdig and Hunt.io. The earliest of those reports is dated 2026-08-04 and the most recent 2026-10-03.

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

AddressTransactionTypeRoleMalware familyFirst writtenLast written
0x2dbca26addf031ada655861933d0386a39ea6427 Etherscan Wallet, ethereum owner wallet EtherRAT 2026-04-04 2026-04-04
0x8b12e09abb2e5130310b24c75b51c8afd85e8223 Etherscan Contract, ethereum mapping contract EtherRAT 2026-04-04 2026-04-04
0x40b57c3622c1cbfd699207f71f2de5a8fe256893 Etherscan Wallet, ethereum owner wallet EtherRAT 2026-04-01 2026-04-01
0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 Etherscan Contract, ethereum mapping contract EtherRAT 2026-04-01 2026-04-01

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-08-04 · last seen 2026-10-03

Registration

Registered2026-03-31
RegistrarMetaregistrar BV
Expires2027-03-31
Last changed2026-05-19
Statusclient transfer prohibited

From the registry’s RDAP record for publisherresolution.com, looked up 2026-10-05.

Sources

  • Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-04-04, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-31, 4 days before the write, through Metaregistrar BV with nameservers ns1.nulled-ns.com and ns2.nulled-ns.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. Hunt.io lists it as the first C2 (2026-04-01) of a second EtherRAT contract, 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831, which it ties to an affiliate of The Gentlemen ransomware operation.
    EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 — Chollima Hunter (on-chain observation) · pulled 2026-10-03
  • Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-04-04, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-31, 4 days before the write, through Metaregistrar BV with nameservers ns1.nulled-ns.com and ns2.nulled-ns.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. Hunt.io lists it as the first C2 (2026-04-01) of a second EtherRAT contract, 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831, which it ties to an affiliate of The Gentlemen ransomware operation.
    EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · pulled 2026-10-03

  • As printed:

    publisherresolution[.]com

    Notes:

    Value written to the EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 by operator wallet 0x2dbca26addf031ada655861933d0386a39ea6427 on 2026-04-04, as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-03-31, 4 days before the write, through Metaregistrar BV with nameservers ns1.nulled-ns.com and ns2.nulled-ns.com. The registration pattern, not the name, is what separates this from the parked and compromised-site values operators also write. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. Hunt.io lists it as the first C2 (2026-04-01) of a second EtherRAT contract, 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831, which it ties to an affiliate of The Gentlemen ransomware operation.
    The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 — Hunt.io · published 2026-08-04 · pulled 2026-10-03

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223

Chollima Hunter (on-chain observation) lists 6 other indicators in this source. 5 are shown, chosen across types.

All 7 indicators from this source

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 4 are shown, chosen across types.

All 57 indicators from this source

Cited by the same report: The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

Hunt.io lists 6 other indicators in this source. 3 are shown, chosen across types.

All 7 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.