0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9
0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9 is a transaction hash
that one published source reports
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Ransom-ISAC.
The report is dated 2025-12-08.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Source
-
DEV#POPPER.JS RAT VARIATIONS 071025_0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9_FINAL.txt 913081a0cfad76e49c6c7eff89ef31a599e60d0288fe0576e8c61e75eda36517
BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: listed in Ransom-ISAC's part 4 indicator table as a cross-chain pointer target of TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe; named in the file name of a deobfuscated DEV#POPPER.JS RAT variant in Ransom-ISAC's part 4 indicator table (071025_0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9_FINAL.txt), which the post lists among payload transactions from wallet 0x9bc1355344b54dedf3e44296916ed15653844509. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.