CTI · reviewed · 2026-09-29

DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware

Full story & timeline

Actors

DPRK-linked operators

Malware / tools

DEV#POPPER.jsOmniStealer

Campaigns

Cross-Chain TxDataHiding (XCTDH)HashHiding

CVEs

—

Victim sectors

technologycryptocurrency

Geography

—

MITRE ATT&CK

T1195 Supply Chain Compromise Initial Access
T1566 Phishing Initial Access
T1071 Application Layer Protocol Command and Control
T1105 Ingress Tool Transfer Command and Control
T1059 Command and Scripting Interpreter Execution

Indicators

Observables tied to this case, from the curated feed. raw sidecar

166.88.134.62 ipv4 · expired
16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 sha256 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Node.js Command Line With XCTDH HashHiding Markers
id: 9ffa244a-594a-42e9-833f-327be09646b6
status: experimental
description: >
    Detects Node.js launched with -eval strings carrying the XCTDH
    HashHiding indicators published by Ransom-ISAC (2026): the campaign
    marker global.i = '5-3-132' and the require-alias global.r=require used
    by the base-91, control-flow-flattened _Z module that decodes a C2
    endpoint from Ethereum recipient-address bytes.
references:
    - https://ransom-isac.org/blog/xctdh-adopts-hash-hiding/
    - https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique
author: Tia N. List
date: 2026/09/29
tags:
    - attack.t1059
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'global.i='
            - 'global.r=require'
    condition: selection
falsepositives:
    - Developer scripts or test harnesses that legitimately define the same
      globals (rare; correlate with a subsequent fetch to a bare IP endpoint)
level: high

YARA-X raw

rule DPRK_XCTDH_HashHiding_JS_Payload {
    meta:
        author = "Tia N. List"
        date = "2026-09-29"
        status = "experimental"
        description = "JavaScript/Node.js payload of the DPRK-linked XCTDH HashHiding campaign: the base-91, control-flow-flattened _Z module decoded from the C2 /init response that decodes a C2 endpoint from Ethereum recipient-address bytes. Keys on the campaign marker, decode substrings, campaign marker string and operator signal-wallet prefix published by Ransom-ISAC and OpenSourceMalware. Derived from case analysis - NOT validated against a live sample."
        reference = "https://ransom-isac.org/blog/xctdh-adopts-hash-hiding/"
        falsepositives = "Threat-intelligence writeups, YARA repositories and sandbox reports that quote these indicator strings verbatim; confirm the file is executable JavaScript on a developer host before acting"
    strings:
        $marker = "RS260605" ascii
        $campaign = "global.i = '5-3-132'" ascii nocase
        $decode = ".to.substring(2,10)" ascii
        $wallet = "33ff3edaf55a8e03dcbc7cb40d498a49" ascii nocase
        $boot = "/$/boot" ascii
    condition:
        3 of them
}