North Korean-linked attackers are employing a novel method to conceal servers that control malware. This approach embeds a command server address within an empty Ethereum transaction, making it appear as though it's merely a normal crypto transfer rather than a signal for malicious software. The tactic was discovered in two malicious npm packages: bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8.
OpenSource Malware revealed in a report shared with ZeroOwl (ZeroOwl) that the campaign appears linked to the DPRK-backed Contagious Interview operation, which has repeatedly targeted developers via trusted-looking projects and packages. Unlike traditional methods relying on visible web domains or fixed server addresses, this malware can retrieve new instructions from a public blockchain that is hard to disable or alter by defenders.
Supply chain risks grow The affected packages use Node.js to query public Ethereum RPC services, examine the latest transfer from the attacker’s wallet, decode the recipient address, and contact the resulting server. The attack poses significant risks for developers as harmful npm dependencies can easily infiltrate workstations, build systems, and software projects through typical installation commands. marker C2 IP address 166.88.134.62 Decoded command-and-control infrastructure C2 endpoint 166.88.134.62:443 HTTPS command-and-control endpoint C2 endpoint 166.88.134.62:80 HTTP command-and-control endpoint Blockchain RPC URL https://1rpc.io/eth Ethereum RPC service queried by the malware Blockchain RPC URL https://eth.drpc.org Ethereum RPC service queried by the malware
