Loading threat actor…
EtherHiding is a blockchain-based malware delivery and infrastructure-concealment technique associated with North Korean attackers. The technique involves abusing smart contracts to hide malicious content or operational infrastructure details, complicating detection and takedown efforts by shifting attacker-controlled data into decentralized blockchain components. Google Threat Intelligence Group reported North Korean use of this method from February 2025 and characterized it as a new form of bulletproof hosting. Observed tradecraft includes storing or retrieving malicious payload material or proxying information through smart contracts, enabling rapid rotation of infrastructure elements and frustrating conventional blocking approaches. EtherHiding is a technique designation rather than a well-defined standalone intrusion set, and no distinct sub-groups are established in the available information.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.