North Korea-linked malware abuses Ethereum transactions as covert C2 channel

Ransom-ISAC researchers identified a North Korea-linked campaign, tracked through the XCTDH malware family, that hides its command-and-control server location inside Ethereum transfers rather than in the blockchain itself. The technique, called HashHiding, encodes the server address into the recipient address of a transfer: the first four bytes carry the server IP and the next two carry the port. Most of the transfers move no cryptocurrency at all. The malware watches the operator's signaling wallet, scans recent blocks through public access points, decodes the address, and contacts the revealed server, which supplies code to rebuild the infection.

The campaign reaches developers through fake job offers, tainted code repositories, and malicious software packages, and installs a remote access tool plus a credential stealer across Windows, macOS, and Linux. Ransom-ISAC first documented the operation in October 2025, found Ethereum signaling beginning in June 2026, and counted 2,655 transactions over 90 days in September 2026 samples. The report does not establish how many machines were infected or how much data was taken.

Resilience is the design goal. The operator changed the encoded destination four times during the observed window, at one point altering only the final digit of the address, a shift designed to slip past blocklists. Ethereum is a backup path in a multi-chain scheme: the loader checks TRON first, falls back to Aptos, and an older route delivers encrypted JavaScript stored in BNB Smart Chain transactions. The method is distinct from the earlier NullReceiver technique, which Ransom-ISAC credits while tracing this campaign through its own on-chain collection.

Watch for wallet-based blocking as the practical mitigation: IP blocklists fail by design here, so defenders need to flag the signaling wallet and its successor addresses. Development-targeting lures remain the entry vector, so job-offer phishing and package-repo hygiene deserve attention in teams that touch cryptocurrency tooling.