North Korean-linked attackers are using a new way to hide the servers that control malware.
The method places a command server address inside an empty Ethereum transaction, making the activity look like a normal crypto transfer rather than a malware signal.
The technique was found in two malicious npm packages, bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8.
Both packages impersonated legitimate Tailwind CSS plugins, creating a supply-chain risk for developers who install dependencies without closely reviewing their source.
Analysts at OpenSource Malware identified the activity and named the technique NullReceiver.
OpenSource Malware said in a report shared with Cyber Security News (CSN) that the campaign appears connected to the DPRK-linked Contagious Interview operation, which has repeatedly targeted developers through trusted-looking projects and packages.
Nullreceiver C2 Resolution Sequence (Source – OpenSource Malware)
The discovery shows how software supply-chain threats are becoming harder to spot. Instead of relying on a visible web domain or a fixed server address, the malware can retrieve new instructions from a public blockchain that cannot easily be taken down or altered by defenders.
North Korean Hackers Are Hiding Malware Servers
NullReceiver works by reading the recipient address from the latest outgoing transaction of an attacker-controlled Ethereum wallet. That recipient is not a genuine payment destination.
Its address bytes are deliberately chosen so that part of the value converts into the IP address of the malware’s command-and-control server.
The transfer contains no payment value and no transaction input data. This helps it blend into ordinary blockchain activity because there is no smart contract call, hidden script, or payload field for security tools to inspect.
The decoded command server directs infected systems to the next stage of the operation.
This design differs from EtherHiding, where attackers store command data in a transaction’s calldata or a smart contract.
Recent reporting on EtherRAT and EtherHiding malware showed how blockchain-based infrastructure can give attackers a resilient way to redirect compromised machines after traditional servers are blocked.
Nullreceiver Threat Graph (Source – OpenSource Malware)
NullReceiver is more limited because it can only carry a small amount of information, such as an IP address.
However, it is cheaper to operate, less obvious on-chain, and avoids EtherHiding’s use of a predictable destination address that defenders can monitor from the start.
Supply Chain Risks Grow
The affected packages use Node.js code to query public Ethereum remote procedure call services, examine the attacker wallet’s latest transfer, decode the recipient address, and contact the resulting server.
Researchers did not execute the packages; their findings came from static analysis and read-only blockchain checks.
The attack is especially concerning for developers because malicious npm dependencies can enter workstations, build systems, and software projects through everyday installation commands.
A similar large npm package compromise demonstrated how stolen developer and cloud credentials can rapidly expand a supply-chain incident across many packages.
Security teams should review dependency updates before deployment, investigate unexpected outbound blockchain RPC traffic, and monitor for applications that inspect transaction recipient addresses.
Once a malicious wallet is known, defenders can track its transfers and identify newly encoded infrastructure before infected systems connect.
Organizations should also restrict unnecessary access to cryptocurrency RPC providers, isolate machines that installed the identified packages, and rotate exposed developer credentials.
These precautions matter as North Korean developer targeting continues to rely on convincing software lures rather than software vulnerabilities alone.
Indicators of Compromise (IoCs):-
TypeIndicatorDescriptionMalicious npm packagebianira-ui@1.27.0Trojanized npm package using NullReceiverMalicious npm packagefluid-type-ui@2.0.8Trojanized npm package using NullReceiverEthereum wallet0xa322e5f3d311d3080e6f0121063e9adc2490ef1aAttacker-controlled wallet queried by the malwareEncoded recipient address0xa658863ea658863e68656c6c6f6970626f742121Recipient address used to encode the C2 IP and helloipbot!! markerC2 IP address166.88.134.62Decoded command-and-control infrastructureC2 endpoint166.88.134.62:443HTTPS command-and-control endpointC2 endpoint166.88.134.62:80HTTP command-and-control endpointBlockchain RPC URL RPC service queried by the malwareBlockchain RPC URL RPC service queried by the malware
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN
The post North Korean Hackers Are Hiding Malware Servers Inside Empty Crypto Transfers appeared first on Cyber Security News.
