EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
Pulse ID: 69ca1c1315c96fd0b4101d4c
Pulse Link: https://otx.alienvault.com/pulse/69ca1c1315c96fd0b4101d4c
Pulse Author: Tr1sa111
Created: 2026-03-30 06:45:39
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CDN #CyberSecurity #EtherHiding #InfoSec #OTX #OpenThreatExchange #RAT #bot #Tr1sa111
EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
EtherRAT, a Node.js-based backdoor linked to a North Korean APT group, was detected in a retail customer's environment. It allows arbitrary command execution, extensive system information gathering, and asset theft. The malware uses 'EtherHiding' to store C2 addresses in Ethereum smart contracts, making infrastructure resilient to takedowns. It communicates using CDN-like beaconing to blend with normal traffic. Initial access varied, including ClickFix and IT Support scams via Microsoft Teams. A SYS_INFO module performs comprehensive host fingerprinting for target selection. The malware checks for CIS languages and self-destructs if found. It collects detailed system information, including hardware, software, and network details.
Pulse ID: 69c5a04382b357bdc81343b4
Pulse Link: https://otx.alienvault.com/pulse/69c5a04382b357bdc81343b4
Pulse Author: AlienVault
Created: 2026-03-26 21:08:19
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #CDN #CyberSecurity #ELF #EtherHiding #InfoSec #Korea #Malware #Microsoft #MicrosoftTeams #Nodejs #NorthKorea #OTX #OpenThreatExchange #RAT #bot #AlienVault
Des cybercriminels au service de la Corée du Nord ont développé une technique sophistiquée pour dissimuler leurs programmes malveillants : ils exploitent désormais la blockchain Ethereum comme refuge numérique. Cette méthode inédite, baptisée « EtherHiding », transforme l'infrastructure décentralisée des cryptomonnaies en arsenal offensif. Les chercheurs en cybersécurité tirent la sonnette d'alarme face à cette escalade technologique.
Une méthode inédite, baptisée « #EtherHiding », transforme la #blockchain de #cryptomonnaies #Ethereum en arsenal offensif. Les #chercheurs en #cybersécurité de #Google tirent la sonnette d' #alarme face à cette escalade #technologique
Des cybercriminels au service de la Corée du Nord ont développé une technique sophistiquée pour dissimuler leurs programmes malveillants : ils exploitent désormais la blockchain Ethereum comme refuge numérique. Cette méthode inédite, baptisée « EtherHiding », transforme l'infrastructure décentralisée des cryptomonnaies en arsenal offensif. Les chercheurs en cybersécurité tirent la sonnette d'alarme face à cette escalade technologique.
Source et contexte: Expel (blog, Marcus Hutchins, 20 janv. 2026) publie une analyse technique de la campagne malware ClearFake/ClickFix, active sur des centaines de sites compromis et axée sur l’évasion défensive. • Ce que fait ClearFake: framework JavaScript malveillant injecté sur des sites piratés, affichant un faux CAPTCHA “ClickFix” qui incite l’utilisateur à faire Win+R puis à coller/valider une commande, déclenchant l’infection. La chaîne JS est obfusquée et prépare des charges ultérieures.
EtherHiding emerges as a malware delivery mechanism!
Google threat intelligence is reporting North Korean nation-state actor "UNC5342" is leveraging transactions on public blockchains to store and retrieve malicious payloads.
EtherHiding executes a social engineering campaign (fake job interviews, crypto games) as the initial compromise to lure developers — often those working in the cryptocurrency or tech industries — into downloading malware disguised as job-related files or coding challenges.
Once a target opens the file, a malicious script connects to a public blockchain like BNB Smart Chain or Ethereum, to retrieve encrypted code from a smart contract. That code installs a JadeSnow loader, which in turn delivers a more persistent backdoor known as InvisibleFerret that has been used in multiple cryptocurrency thefts.
https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding #Security #CyberSecurity #Hackers #CyberAttack #UNC5342 #Google #Malware #SmartContracts #Crypto #CryptoCurrency #EtherHiding #SocialEngineering #BlockChain
Google reports DPRK group UNC5342 uses EtherHiding to deliver backdoors and steal crypto, marking the first nation-state use of a tactic designed for resistant attacks.
North Korean hackers are taking stealth to a new level: embedding malware into blockchain smart contracts and tricking devs with fake job interviews. Are we ready for a world where your next code review could be a trap?
#etherhiding
#northkoreanhackers
#blockchainsecurity
#malwaredistribution
#smartcontracts
#cyberthreats
#socialengineering
#infosec
OTX Bot
Rod2ik 🇪🇺 🇨🇵 🇪🇸 🇨🇱 🇺🇦 🇨🇦 🇬🇱 ☮🕊️
Rod2ik 🇪🇺 🇨🇵 🇪🇸 🇨🇱 🇺🇦 🇨🇦 🇬🇱☮🕊️
CyberVeille.ch
goneo
BGDon 🇨🇦 🇺🇸 👨💻
Ivan
eicker.news ᳇ tech news
The DefendOps Diaries