NullReceiver: North Korea-linked hackers refine EtherHiding technique for C2 IP concealment

Cybersecurity researchers have detected an evolution of the EtherHiding blockchain-based command-and-control (C2) technique, which conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer.

The new dead drop resolver approach, codenamed NullReceiver by OpenSourceMalware, has been linked to North Korean hacking groups and involves embedding the C2 IP address in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer.

NullReceiver aims to improve upon EtherHiding's shortcomings, which requires a fixed, publicly known destination address that can be tracked by defenders. In contrast, NullReceiver provides a non-existent destination address, making attribution difficult and eliminating the 'fixed, watchable destination.'

The technique has been used in two trojanized npm packages, bianira-ui and fluid-type-ui, which have been downloaded hundreds of times since their publication on July 28, 2026. The packages leverage JavaScript libraries to extract the IP address and connect to it, making it challenging for defenders to detect.

As of writing, a total of 68 transactions have taken place since July 27, 2026, with the destination 'To' address being the same for each transaction: '0xa658863ea658863e68656c6c6f6970626f742121.'

The absence of a fixed target and fingerprint makes NullReceiver more sneaky, and its transactions are cheaper than before. While EtherHiding can smuggle a full URL or script, NullReceiver can only encode a few bytes.