← EtherHiding Tracker

0xe26c57b7fa8de030238b0a71b3d063397ac127d3

0xe26c57b7fa8de030238b0a71b3d063397ac127d3 is a smart contract address that 4 published sources report in connection with EtherHiding / UNC5342, unclustered DPRK and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hokage Vanguard, Sysdig, Atos Threat Research Center and e Sentire. The earliest of those reports is dated 2026-03-25 and the most recent 2026-05-22.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Show 50 more

smart contract address EtherHiding / UNC5342DPRK (cluster unattributed)Lazarus Group CURATED

Listed as Ethereum

First seen 2026-03-25 · last seen 2026-05-22

Sources

• As printed:

  0xe26c57b7fa8de030238b0a71b3d063397ac127d3

  Notes:

  Ethereum contract that EtherRAT reads to find its command-and-control server. It stores a mapping from operator wallet to URL: the operator writes the current C2 with setString(string), and the implant reads it back with getString(address) (selector 0x7d434425) through a read-only eth_call that leaves no transaction. Hokage Vanguard reported the contract and its operator wallet and attributes the activity to Lazarus; Sysdig, which first described EtherRAT, attributes the implant to DPRK without naming a cluster, and this entry follows the narrower attribution. The checker on this site reads the operator's current value and the full write history on every run, so a rotation shows up as a change.

  EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus — Hokage Vanguard · published 2026-05-22 · pulled 2026-10-03

• Ethereum contract that EtherRAT reads to find its command-and-control server. It stores a mapping from operator wallet to URL: the operator writes the current C2 with setString(string), and the implant reads it back with getString(address) (selector 0x7d434425) through a read-only eth_call that leaves no transaction. Hokage Vanguard reported the contract and its operator wallet and attributes the activity to Lazarus; Sysdig, which first described EtherRAT, attributes the implant to DPRK without naming a cluster, and this entry follows the narrower attribution. The checker on this site reads the operator's current value and the full write history on every run, so a rotation shows up as a change.

  EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · pulled 2026-10-03

• As printed:

  0xe26c57b7fa8de030238b0a71b3d063397ac127d3

  Notes:

  Ethereum contract that EtherRAT reads to find its command-and-control server. It stores a mapping from operator wallet to URL: the operator writes the current C2 with setString(string), and the implant reads it back with getString(address) (selector 0x7d434425) through a read-only eth_call that leaves no transaction. Hokage Vanguard reported the contract and its operator wallet and attributes the activity to Lazarus; Sysdig, which first described EtherRAT, attributes the implant to DPRK without naming a cluster, and this entry follows the narrower attribution. The checker on this site reads the operator's current value and the full write history on every run, so a rotation shows up as a change.

  EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• …infected machines at the cost of a small amount of crypto. Figure 8 – Retrieve C2 via EtherHiding The Ethereum smart contract address 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 in this incident appears frequently in eSentire case data related to EtherRAT and has also been associated with attacks against other…

  EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons — e Sentire · under “Acquire C2 Address via EtherHiding” · published 2026-03-25 · pulled 2026-10-03

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus

Hokage Vanguard lists 20 other indicators in this source. 5 are shown, chosen across types.

• fsecure.centralus.cloudapp.azure.com domain
• hayesmed.com domain
• 185.227.144.114 IP address
• 46.38.156.25 IP address
• 0x8d7e3cc5342439ff28c589a902b685ea4d398c12 cryptocurrency wallet address

All 21 indicators from this source

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 4 are shown, chosen across types.

• asian-sagem-canal-nest.trycloudflare.com domain
• 193.24.123.68 IP address
• 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 smart contract address
• 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d cryptocurrency wallet address

All 57 indicators from this source

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 3 are shown, chosen across types.

• 91.221.190.12 IP address
• pxmon/Process-Explorer malicious repository
• 0xd9afc5c883f45206c916d8e312c2d9f13766344d cryptocurrency wallet address

All 97 indicators from this source