← EtherHiding Tracker

0xdf0b529043ef7a2bb9111bad26de624a326bacf9

0xdf0b529043ef7a2bb9111bad26de624a326bacf9 is a smart contract address that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from The DFIR Report and Sysdig. The reports are dated 2026-05-11.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Show 50 more

smart contract address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-05-11 · last seen 2026-05-11

Sources

• As printed:

  0xdf0b529043ef7a2bb9111bad26de624a326bacf9

  Notes:

  A second EtherRAT resolver contract of the same getString(address) / setString(string) design (selectors 0x7d434425 and 0x7fcaf666). The DFIR Report lists it and its operator wallet among the indicators of an April 2026 intrusion in which EtherRAT's configuration on Ethereum was repeatedly rewritten to point at TryCloudflare tunnels. This site read its write history on 3 October 2026: the operator wrote 31 values between 24 April and 1 October 2026, alternating TryCloudflare tunnels with parked values naming well-known domains, so a new value here is reviewed before it is treated as an indicator. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.

  Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware — The DFIR Report · published 2026-05-11 · pulled 2026-10-03

• A second EtherRAT resolver contract of the same getString(address) / setString(string) design (selectors 0x7d434425 and 0x7fcaf666). The DFIR Report lists it and its operator wallet among the indicators of an April 2026 intrusion in which EtherRAT's configuration on Ethereum was repeatedly rewritten to point at TryCloudflare tunnels. This site read its write history on 3 October 2026: the operator wrote 31 values between 24 April and 1 October 2026, alternating TryCloudflare tunnels with parked values naming well-known domains, so a new value here is reviewed before it is treated as an indicator. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.

  EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · pulled 2026-10-03

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

The DFIR Report lists 12 other indicators in this source. 7 are shown, chosen across types.

• afford-effect-construct-tricks.trycloudflare.com domain
• entered-medications-motherboard-advanced.trycloudflare.com domain
• fields-pct-easier-vancouver.trycloudflare.com domain
• howto-tar-naturals-coordination.trycloudflare.com domain
• mode-exit-legendary-trusted.trycloudflare.com domain
• rapids-lil-lending-charleston.trycloudflare.com domain
• 0x5953f27f044779a3afcd2bf56a4b712583dd2e4e cryptocurrency wallet address

All 13 indicators from this source

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 5 are shown, chosen across types.

• api-gateway-softupdate.io domain
• asian-sagem-canal-nest.trycloudflare.com domain
• 193.24.123.68 IP address
• 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 smart contract address
• 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d cryptocurrency wallet address

All 57 indicators from this source