UNC5142 Uses EtherHiding to Deploy Malware via BNB Smart Chain Smart Contracts

A new joint analysis by Mandiant Threat Defense and Google Threat Intelligence Group (GTIG) has exposed a financially motivated threat cluster, tracked as UNC5142, which uses blockchain technology to conceal and distribute information-stealing malware by embedding malicious code inside BNB Smart Chain smart contracts.

According to Mandiant Threat Defense and Google Threat Intelligence Group, since late 2023 UNC5142 has evolved its TTPs to enhance operational security and evade detection, with EtherHiding obscuring malware by placing it on a public blockchain. Rather than relying on conventional servers, the group hides payloads inside self-executing smart contracts on the BNB Smart Chain, enabling long-term persistence and resilience against takedowns.

As of June 2025, GTIG had identified approximately 14,000 web pages with injected JavaScript consistent with a UNC5142-compromised website, used to load CLEARSHORT, a JavaScript downloader that initiates the attack chain from vulnerable WordPress sites.

The infection chain centres on a multi-level smart contract system where first-level contracts act as routers, second-level contracts perform reconnaissance, and third-level contracts host encrypted payload URLs and AES keys for final malware retrieval, with updates costing between $0.25 and $1.50 USD in network fees.

UNC5142 distributes malware such as VIDAR and LUMMAC.V2 for Windows, RADTHIEF for credential theft, and ATOMIC for macOS, while abusing Cloudflare Pages to host lure pages and retain operational stability.