Full Report
Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm package "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by
Analysis Summary
# Tool/Technique: NullReceiver
## Overview
**NullReceiver** is a sophisticated evolution of the "EtherHiding" technique used for blockchain-based Command-and-Control (C2) resolution. Instead of using smart contracts or transaction calldata, NullReceiver encodes C2 IP addresses directly into the hex-bytes of a destination address for a zero-value Ethereum transfer. This acts as a "dead drop resolver," allowing malware to dynamically discover C2 infrastructure by querying public blockchain ledgers.
## Technical Details
- **Type:** Technique / Dead Drop Resolver
- **Platform:** Cross-platform (JavaScript/Node.js via npm packages)
- **Capabilities:** Stealthy C2 resolution, evasion of static IP/domain blacklisting, resistance to infrastructure takedowns.
- **First Seen:** July 28, 2026 (Reported date)
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1102 - Web Service]**
- **[T1102.001 - Bidirectional Communication]** (Using blockchain as a dead drop resolver)
- **[TA0001 - Initial Access]**
- **[T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools]**
## Functionality
### Core Capabilities
- **C2 Encoding in Addresses:** Encodes the 4-byte IPv4 address into the first four bytes of a destination Ethereum address (e.g., `0xa658863e...` translates to `166.88.134[.]62`).
- **Dynamic Lookup:** The malware queries a hardcoded "source" attacker wallet on the Ethereum blockchain to find the most recent outbound transaction.
- **Zero-Value Transactions:** Uses transactions with no ETH value and no data (calldata), making them appear as "null" or "empty" transfers to casual observers.
### Advanced Features
- **Elimination of Fixed Destinations:** Unlike original EtherHiding, NullReceiver uses "made-up" destination addresses that do not correspond to real users or smart contracts, preventing defenders from "watching" a single malicious contract for updates.
- **Payload Verification:** Includes trailing ASCII strings in the destination address (e.g., `helloipbot!!`) to verify the transaction is indeed part of the C2 infrastructure.
## Indicators of Compromise
- **File Names (Trojanized npm packages):**
- `bianira-ui`
- `fluid-type-ui`
- **Network Indicators (Defanged):**
- **C2 IP:** `166.88.134[.]62`
- **Attacker Wallet:** `0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`
- **Generated "Null" Destination:** `0xa658863ea658863e68656c6c6f6970626f742121`
- **Behavioral Indicators:**
- npm packages initiating outbound requests to Ethereum blockchain explorers (e.g., `etherscan.io`) or JSON-RPC nodes immediately upon execution.
- Unexpected network connections to external IPs shortly after blockchain queries.
## Associated Threat Actors
- **Lazarus Group / DPRK-linked actors:** Associated with the "Contagious Interview" campaign and North Korean cyber espionage efforts.
## Detection Methods
- **Behavioral Detection:** Monitor for Node.js processes communicating with public blockchain APIs or RPC nodes followed by connections to previously unseen IP addresses.
- **Blockchain Monitoring:** Track specific attacker-controlled wallets for outbound transactions where the destination address follows the NullReceiver hex-encoding pattern (IP prefix + "helloipbot!!" suffix).
- **Supply Chain Scanning:** Analyze npm package updates for code that imports Ethereum interaction libraries (like `ethers.js` or `web3.js`) without a clear functional requirement.
## Mitigation Strategies
- **Dependency Pinning:** Use `package-lock.json` and avoid automatic updates of third-party libraries.
- **Egress Filtering:** Restrict server environments from communicating with arbitrary external IPs; use allowlists for known-good services.
- **SCA Tools:** Utilize Software Composition Analysis (SCA) tools to flag newly published or "typosquatted" packages with low reputation/download counts.
## Related Tools/Techniques
- **EtherHiding:** The predecessor technique utilizing BNB Smart Chain/Ethereum smart contract calldata.
- **Contagious Interview:** The broader campaign involving fake job recruitment to deploy malware.
- **Dead Drop Resolvers:** General technique of using legitimate third-party services (GitHub, Pastebin, Blockchain) to host C2 information.