Trojanized npm Packages Use Ethereum for C2 IP Hiding

Cybersecurity researchers have identified a novel evolution of the EtherHiding technique, which leverages blockchain technology to conceal command-and-control (C2) server IP addresses. This advanced method embeds the C2 server's IP address within a fabricated destination address of an entirely empty Ethereum transfer. This approach, termed the NullReceiver dead drop resolver, was discovered within two trojanized npm packages: "bianira-ui" and "fluid-type-ui." The technique circumvents traditional detection methods by using the Ethereum blockchain as a covert channel for communication, making it significantly harder for security professionals to trace malicious infrastructure.

The NullReceiver technique exploits the structure of Ethereum transactions. Instead of a legitimate recipient address, a specially crafted, invalid address is used. This address, however, is designed to be interpretable by the malware as containing the IP address of the C2 server. When the malware initiates an empty transaction to this malformed address, the Ethereum network processes it without error, but the malware on the infected system can then parse the address to extract the C2 server's IP. This method effectively uses the blockchain as a distributed, immutable dead drop for critical command-and-control information, making it resilient to takedowns and difficult to monitor.

The discovery of this technique in the "bianira-ui" and "fluid-type-ui" npm packages highlights a growing trend of sophisticated supply chain attacks targeting the open-source software ecosystem. npm, the default package manager for Node.js, is widely used by developers globally, making its packages a prime target for malicious actors. By compromising popular or seemingly legitimate packages, attackers can distribute malware to a broad range of users and organizations. The inclusion of the NullReceiver technique suggests a deliberate effort by the attackers to create a more persistent and evasive C2 infrastructure, moving beyond conventional methods that are often quickly identified and blocked by security solutions.

This development underscores the increasing complexity of cybersecurity threats, particularly those that integrate with decentralized technologies like blockchain. The ability of attackers to leverage the immutability and distributed nature of blockchains for malicious purposes presents new challenges for defenders. Security researchers are urging developers to exercise extreme caution when incorporating third-party libraries and packages into their projects, emphasizing the importance of thorough vetting, dependency scanning, and staying updated on emerging threat vectors. The EtherHiding family of malware, which this new technique builds upon, has previously been documented by security firms for its ability to conceal C2 infrastructure, but the NullReceiver method represents a significant advancement in its stealth capabilities.