DPRK Hackers Hide C2 Infrastructure in Ethereum Transactions

North Korean-linked hackers have developed a new malware technique that hides command-and-control (C2) infrastructure inside ordinary Ethereum transactions, according to researchers. This method, dubbed NullReceiver, was found in two trojanized npm packages: bianira-ui@1.27.0 and fluid-type-ui@2.0.8, which impersonate legitimate Tailwind CSS plugins.

The malicious packages are linked to the DPRK's Contagious Interview campaign. Instead of embedding a malicious domain or IP address directly in code, the malware retrieves its C2 server from the Ethereum blockchain at runtime.

This makes it more difficult to block the attacker's infrastructure and gives operators a resilient public dead-drop mechanism.