DPRK Hackers Debut NullReceiver Malware, a Stealthier Upgrade to EtherHiding

North Korean state hackers have quietly upgraded their blockchain-based command-and-control tradecraft, and this time they’ve engineered out the one flaw that got their last technique caught.

Researchers at OpenSourceMalware have identified a new C2 resolution method, dubbed NullReceiver, embedded in two trojanized npm packages tied to the DPRK’s Contagious Interview campaign.

The malicious packages, bianira-ui@1.27.0 and fluid-type-ui@2.0.8, are clones of legitimate Tailwind CSS plugins. Instead of hardcoding a C2 domain or IP address, both retrieve their command server from Ethereum at runtime by looking up a hardcoded attacker wallet, 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, and reading the recipient address of its most recent outbound transaction.

That transaction carries zero value and an empty input field, "0x", making it indistinguishable from an ordinary wallet-to-wallet transfer. The trick is that the “to” address was never meant to receive funds; its bytes decode directly into an IPv4 address, 166.88.134.62, with trailing bytes spelling out “helloipbot!!” as an attacker fingerprint.

The code queries public RPC endpoints, including 1rpc.io/eth and eth.drpc.org, and carries the static string "A10-npm3!" as a detection signature researchers extracted through static analysis, without executing the packages.

This is a direct answer to EtherHiding, the blockchain C2 technique Google Threat Intelligence tied to DPRK actor UNC5342 in October 2025.

EtherHiding sends transactions to Ethereum’s well-known burn address and stuffs the actual C2 URL or script into the calldata field. That gave defenders a permanent landmark: monitor one address, forever, and flag anything unusual sent there.

DPRK Hackers Debut NullReceiver Malware, a Stealthier Upgrade to EtherHiding

NullReceiver removes that landmark entirely. Every lookup uses a brand-new, disposable recipient address, and there’s no calldata to fingerprint. It’s also the cheapest possible transaction shape on the network, since gas costs scale with payload bytes and this payload has none.

“What makes NullReceiver dangerous isn’t cleverness in the cryptography; there isn’t any. It’s that DPRK operators are treating public criticism as a design spec. Every time researchers publish IOCs for a technique, the next campaign ships with that exact weakness patched out. Defenders are effectively co-authoring the next version of the malware every time they publish a takedown report.”

EtherHiding still wins on raw capacity, capable of smuggling a full URL or script, while NullReceiver can only encode a few bytes, enough for an IP address. Both techniques share a residual weakness: the sending wallet is reused across a campaign, so once analysts flag it, they can watch future transactions the same way they’d watch a burn address.

Security teams should expand blockchain-monitoring heuristics beyond smart-contract calls and non-empty calldata to include zero-value, zero-data transfers from suspicious wallets, particularly where recipient addresses look algorithmically generated rather than real. Given DPRK’s pattern of hardening each burned technique, NullReceiver is a strong candidate to become the ecosystem’s default blockchain dead-drop going forward.