North Korean Hackers Use NullReceiver to Hide C2 IPs in Blockchain Transfers

Cybersecurity researchers have uncovered a sophisticated evolution of the EtherHiding technique, dubbed NullReceiver, that hides command-and-control (C2) server IP addresses inside the recipient field of zero-value Ethereum transfers. The tactic was observed in two trojanized npm packages, "bianira-ui" (109 downloads) and "fluid-type-ui" (587 downloads), both published on July 28, 2026, by users "npmuser1101" and "npmuser3002" respectively. The packages, which have since been removed from npm, have been attributed to North Korean threat actors operating under the Contagious Interview campaign umbrella, originally documented by Google Threat Intelligence Group.

Unlike its predecessor, which encoded malicious payloads within smart contract calldata on BNB Smart Chain or Ethereum, NullReceiver eliminates the need for smart contracts entirely. Security researcher Paul McCarty explained that the malware reads the destination address of the attacker's most recent outbound transaction and decodes a C2 IP directly from those address bytes. By using a non-existent destination address, the technique removes the "fixed, watchable destination" that defenders could track, making attribution significantly harder and eliminating gas fees typically associated with embedding C2 data on-chain.

The Contagious Interview campaign has long relied on LinkedIn lures offering fake job opportunities to trick developers into running malware-laden assessments. NullReceiver represents a meaningful operational upgrade for North Korean operators, enhancing resilience against takedowns while complicating detection pipelines. Defenders monitoring npm dependencies and blockchain-based C2 infrastructure should audit their environments for any exposure to the two flagged packages and review outbound traffic patterns to unfamiliar Ethereum endpoints. Security teams can verify suspicious infrastructure using a WHOIS lookup to investigate unfamiliar registrant data and run a port scanner to confirm exposure on any newly identified C2 endpoints.

The discovery underscores how state-sponsored groups are continuously refining bulletproof hosting methods. As blockchain-based C2 techniques mature, organizations should strengthen supply chain monitoring, enforce strict dependency review policies, and run a privacy checkup to ensure developer endpoints are not leaking telemetry that could aid targeting during the early stages of such campaigns.