Reported by 4 outlets
DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
Operators linked to the DPRK have added a new channel, dubbed HashHiding, to the Cross-Chain TxDataHiding (XCTDH) command-and-control scheme. HashHiding hides an active C2 IP address and port inside the recipient address of ordinary Ethereum transfers, letting infected systems recover attacker infrastructure without domains, smart contracts, or transaction payloads that defenders can blacklist. GBHackers reported the expansion, building on Ransom-ISAC's original disclosure of the campaign.
The earlier XCTDH mechanics remain instructive: the payload shipped in a malicious private GitHub repository impersonating node-react-e-commerce with code hidden in tailwind.config.js (SHA256 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8), delivered via fake LinkedIn job offers. TRON wallets TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG acted as indexes into BSC transaction calldata carrying XOR-encrypted JavaScript, with C2 at 23[.]27[.]20[.]143:27017.
The key detail is continuity: BSC sender wallet 0x9BC1355344B54DEDf3E44296916eD15653844509 was still in use in September 2026 samples, tying current activity to the same operator roughly a year on. Blockchain-resilient C2 defeats takedowns by design, so detection has to focus on the delivery chain, fake recruiter personas and trojaned repositories, rather than on infrastructure. Watch whether other DPRK crews copy the recipient-address encoding trick now that it is public.
Timeline
-
original reporting
DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware
gbhackers.com · 14d ago · September 29th, 2026
DPRK-linked operators behind the Cross-Chain TxDataHiding (XCTDH) campaign have expanded their blockchain-backed command-and-control infrastructure with a new Ethereum-based recovery channel dubbed HashHiding. The technique stores an active C2 IP address and port inside the recipient address of ordinary Ethereum transfers, allowing infected systems to recover attacker infrastructure without relying on domains, smart contracts, or transaction […] The post DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from ransom-isac.org
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1)
ransom-isac.org · 359d ago · October 20th, 2025
Ransom-ISAC's original disclosure of the DPRK-attributed XCTDH campaign, investigated from a malicious private GitHub repository impersonating node-react-e-commerce with the payload hidden in tailwind.config.js (SHA256 16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8). It documents TRON wallets TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG acting as indexes into BSC transaction calldata carrying XOR-encrypted JavaScript, delivered via fake LinkedIn job offers, with C2 at 23[.]27[.]20[.]143:27017. The BSC sender wallet 0x9BC1355344B54DEDf3E44296916eD15653844509 identified here was still in use in the September 2026 samples, confirming the same operator roughly a year on.
-
update from opensourcemalware.com
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding
opensourcemalware.com · 73d ago · August 2nd, 2026
OpenSourceMalware (Paul McCarty) published the first public description of the recipient-address C2 encoding, named NullReceiver, found via static analysis of two trojanised npm packages, bianira-ui@1.27.0 and fluid-type-ui@2.0.8, attributed to the DPRK Contagious Interview campaign. A zero-value, zero-data Ethereum transfer from attacker wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a carries the C2 endpoint 166.88.134.62 encoded in the recipient address bytes, with no smart contract and no calldata to fingerprint. Ransom-ISAC explicitly credits this post for the technique and the name in its September HashHiding report.
-
update from ransom-isac.org
XCTDH Adopts Hash Hiding
ransom-isac.org · 19d ago · September 25th, 2026
The primary research behind this story, by Ellis Stannard and Nick Smart, published three days before the first news rewrites. It documents the _Z module, 69,470 characters of base-91 and control-flow-flattened JavaScript delivered in the C2 /init response, which scans Ethereum mainnet via public RPC providers (publicnode.com, drpc.org, blastapi.io) for transfers from signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 and decodes the C2 endpoint from the first six bytes of the recipient address. Ninety days of on-chain collection show 2,655 beacon transactions from 23 June 2026 to 21 September 2026 with four C2 rotations, currently 181[.]214[.]149[.]148:443, plus a YARA rule and full IOC tables.
-
update from ransom-isac.org
A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encod
ransom-isac.org · 15d ago · September 28th, 2026
A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encod
via X https://ransom-isac.org/blog/xctdh-adopts-hash-hiding/
-
update from cyberpress.org
XCTDH Campaign Uses HashHiding and Blockchain Transactions to Hide Malware C2 Infrastructure
cyberpress.org · 14d ago · September 29th, 2026
The XCTDH campaign already used TRON and Aptos to locate malware payloads stored on BNB Smart Chain (BSC) . Its newer “HashHiding” channel uses ordinary Ethereum transfers to tell infected machines where to find the current C2 server. That transaction points to a BSC transaction whose input field contains encrypted JavaScript. The malware decrypts and runs the code. HashHiding serves a different purpose, it stores an address, not malware code. CyberChef recipe decoding the recipient address into an IPv4 address and port (Source: ransom) It reads the first six bytes of a transaction’s to address as four bytes of IPv4 address and two bytes of port number. The decoded endpoint lets the malware fetch fresh bootstrap code. OpenSourceMalware independently documented the same underlying met
-
mentioned by gbhackers.com
DPRK-Linked Hackers Add New Ethereum-Based HashHiding C2 Channel https:// gbhackers.com/hashhiding-to- blockchain-c2/ … DPRK-linked operator
gbhackers.com · 13d ago · September 30th, 2026