A DPRK-attributed malware campaign has added Ethereum transactions to its command-and-control (C2) system. The XCTDH campaign already used TRON and Aptos to locate malware payloads stored on BNB Smart Chain (BSC).
Its newer “HashHiding” channel uses ordinary Ethereum transfers to tell infected machines where to find the current C2 server.
Ransom-ISAC first documented Cross-Chain TxDataHiding (XCTDH) in October 2025. OpenSourceMalware publicly described the recipient-address technique as “NullReceiver” in August 2026; Ransom-ISAC uses “HashHiding” to describe its role in this wider campaign.
XCTDH Hides C2 On-Chain
In the original XCTDH chain, malware reads a TRON transaction, with Aptos as a fallback. That transaction points to a BSC transaction whose input field contains encrypted JavaScript.
The malware decrypts and runs the code. BSC therefore stores payloads, while TRON and Aptos act as indexes. HashHiding serves a different purpose, it stores an address, not malware code.
In the September 2026 samples described by Ransom-ISAC, a JavaScript module called _Z scans Ethereum blocks for transactions from an operator-controlled wallet.
It reads the first six bytes of a transaction’s to address as four bytes of IPv4 address and two bytes of port number. The decoded endpoint lets the malware fetch fresh bootstrap code.
OpenSourceMalware independently documented the same underlying method of encoding C2 information in a transfer’s recipient address.
For example, the reported recipient address 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 encodes 181[.]214[.]149[.]148:443 in its first six bytes.
It needs no smart contract or transaction calldata. Changing the encoded recipient in a new transfer can change the C2 address without changing code already on a victim’s device.
The September samples reportedly combine the DEV#POPPER.js Node.js remote-access trojan, the _Z Ethereum scanner, and a separate dropper path leading to OmniStealer.
The stealer targets browser data, password managers, cloud storage, and 153 cryptocurrency-wallet targets. Ransom-ISAC says _Z starts alongside the RAT rather than waiting for another C2 route to fail.
According to the supplied 90-day on-chain analysis, the Ethereum signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 sent 2,655 outbound beacons between June 23 and September 21, 2026.
The observed recipient addresses encoded four C2 configurations, ending with 181[.]214[.]149[.]148:443. That is an observation window, not proof that the channel remains active now.
Defenders can monitor transfers from the identified wallet for new recipient addresses and correlate endpoint requests using eth_getBlockByNumber with later connections to decoded IP addresses.
They can also inspect suspicious Node.js processes and weaponized repository files. Blocking one C2 IP alone may not stop an infection if the malware can recover another address or reload code through the cross-chain path.
Indicators of Compromise
| Type | Indicator | Role |
|---|---|---|
| Ethereum signal wallet | 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 | Sends transactions whose recipient addresses encode C2 endpoints. |
| Current encoded recipient | 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 | Encodes 18 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
 system. The XCTDH campaign already){kind=link}