US EditionNation-State Hackers Deliver Malware From “Bulletproof” Blockchains
North Korean hackers use EtherHiding to distribute malware via blockchain smart contracts, enabling stealthy updates with low costs and resistance to takedown, Google researchers found.
- On Thursday, Google Threat Intelligence Group said UNC5342 has used EtherHiding since February to embed malware in smart contracts on public blockchains, marking the first state-backed use of this technique.
- Because smart contracts are immutable and decentralized, decentralization and immutability prevent takedowns, while EtherHiding offers anonymity and low-cost updates, creating a `bulletproof` host, GTIG says.
- Victims are targeted via fake job interviews and fabricated companies to download malicious files from GitHub or NPM, where Jadesnow loads InvisibleFerret and a credential stealer updating contracts over 20 times.
- Security teams are advised to block risky file types, control browser updates, and enforce strict web access and script policies as GTIG says EtherHiding complicates campaign disruption.
- Guardio Labs first documented EtherHiding in 2023, noting it repurposes smart-contract enforcement to create persistent hosting while traditional bulletproof hosts operate in countries without law-enforcement treaties and cater to crime-oriented hosting services.
15 Articles
15 Articles
Nation-state hackers deliver malware from “bulletproof” blockchains
Hacking groups—at least one of which works on behalf of the North Korean government—have found a new and inexpensive way to distribute malware from “bulletproof” hosts: stashing them on public cryptocurrency blockchains. In a Thursday post, members of the Google Threat Intelligence Group said the technique provides the hackers with their own “bulletproof” host, a term that describes cloud platforms that are largely immune from takedowns by law e…
Google: Hackers use EtherHiding on public blockchains
At least two distinct hacking organizations, including a North Korean state-linked actor and a financially motivated criminal group, are leveraging public blockchains to conceal and manage malware, according to research from Google’s Threat Intelligence Group. This method makes their operations highly resistant to conventional takedown efforts. The technique, which researchers have named EtherHiding, fundamentally alters how attackers manage and…
North Korean Hackers Exploit EtherHiding To Spread Malware And Steal Crypto Assets - Cybernoz - Cybersecurity News
The cybersecurity landscape has witnessed a significant evolution in attack techniques with North Korean threat actors adopting EtherHiding, a sophisticated method that leverages blockchain technology to distribute malware and facilitate cryptocurrency theft. EtherHiding represents a fundamental shift in how cybercriminals store and deliver malicious payloads by embedding malware code within smart contracts on public blockchains like BNB Smart C…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
