Loading malware…
EtherHiding is a blockchain-based command-and-control concealment and payload delivery technique in which malware retrieves configuration data, next-stage payloads, or live infrastructure details from public blockchain data rather than relying on fixed traditional servers. Implementations commonly use Ethereum-compatible networks and smart contracts, with malware issuing blockchain read operations to recover encrypted command data, C2 endpoints, or staged JavaScript and loader content at runtime. This design increases resilience against takedown, allows operators to rotate infrastructure without updating deployed malware, and helps malicious traffic blend with legitimate cryptocurrency-related activity.
EtherHiding has been observed across multiple malware delivery chains and software supply-chain compromises, including campaigns targeting developers, cryptocurrency users, and enterprise environments. Reported use cases include npm package compromises, trojanized GitHub repositories, ClickFix-style social engineering chains, fake browser extensions, and cracked-software distribution. Malware families and loaders using EtherHiding have included Node.js backdoors, Python and .NET loaders, infostealers, browser-extension malware, and traffic distribution frameworks. Associated activity has repeatedly overlapped with DPRK-linked operations, including Contagious Interview and UNC5342 tradecraft, though EtherHiding as a technique is not exclusive to a single actor.
Observed capabilities enabled by EtherHiding-backed malware include remote code execution, credential and wallet theft, browser data theft, persistence, staged payload retrieval, and defense evasion through obfuscation and decentralized infrastructure. Variants have used Ethereum, Polygon, BNB Smart Chain, Avalanche, and similar networks to store or resolve attacker-controlled data. Some implementations retrieve encrypted C2 configuration from smart contract storage or contract function outputs, while others use blockchain transactions as a dead-drop mechanism for malicious code or infrastructure pointers. EtherHiding is best understood as a stealth and resilience mechanism embedded within broader malware operations rather than as a standalone payload family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The first category involves smart contract storage-based hiding, exemplified by Etherhiding. This technique stores malicious payloads directly within Ethereum smart contract storage slots, which are retrieved through contract read operations such as eth_call or eth_getStorageAt.
The malware does not rely on a fixed traditional server for its instructions. Instead, it queries Ethereum smart contracts to retrieve live command-and-control, or C2, details. This approach is called EtherHiding.
The malware does not rely on a fixed traditional server for its instructions. Instead, it queries Ethereum smart contracts to retrieve live command-and-control, or C2, details. This approach is called EtherHiding.
The RAT issues an eth_call to read attacker data straight off a smart contract, which is an encrypted next-stage C2 address or config... This is EtherHiding.
The malware abuses Chromium browser trust mechanisms to install the extension without user approval and uses EtherHiding to retrieve its command-and-control infrastructure from the blockchain, making detection and takedown more difficult.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A blockchain-based C2 dropper mentioned as part of separate npm/PyPI campaigns documented by Unit 42.
Referenced as a blockchain-backed C2 technique/pattern used for comparison with Remus's smart-contract-based C2 resolution.
EtherHiding is described as the mechanism used by ChainDrop to retrieve additional payload components via the Ethereum network, helping conceal attacker infrastructure and delivery.
EtherHiding is referenced as a malicious delivery/hosting technique used to conceal or retrieve payloads through blockchain/Ethereum-based infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.