North Korea linked to new NullReceiver C2 technique

The Hacker News reports that North Korean threat actors have developed a new command-and-control (C2) technique called NullReceiver, an evolution of the EtherHiding method. This new approach conceals the C2 server's IP address within an empty Ethereum transaction, making it harder to detect.

The NullReceiver technique, observed in two trojanized npm packages, bianira-ui and fluid-type-ui, embeds the C2 IP address directly into the destination address of a zero-value, zero-data Ethereum transfer. Malware decodes the IP by reading the recipient address of the attacker's most recent outbound transaction. This method improves upon EtherHiding by eliminating the need for a fixed, publicly trackable destination address, making attribution more difficult. The malicious npm packages, which have been downloaded a few hundred times, leverage this technique to extract the IP address and establish a connection. While EtherHiding could smuggle full URLs or scripts, NullReceiver's capacity is limited to encoding just a few bytes. The transactions are also cheaper and less conspicuous as they contain no extra data, making NullReceiver a more stealthy and resilient C2 method.

Source: The Hacker News