Hackers’ “bullet-proof” hosts deliver malware from blockchains

According to Google Threat Intelligence Group, hacking groups associated with the North Korean government have adopted a new technique to distribute malware from “bullet-proof” hosts by stashing payloads on public cryptocurrencies blockchains. The method, called EtherHiding, embeds malware in smart contracts on Ethereum and the BNB Smart Chain, with two or more parties entering into an agreement that can be enforced by the contract terms in a way that is theoretically immutable.

Since February, observers have noted two groups using EtherHiding to infect targets with credential stealers and other malware, including UNC5342, which reportedly uses JadeSnow to fetch later-stage payloads from both the BNB and Ethereum blockchains, and UNC5142, described as also employing EtherHiding.

The researchers highlighted advantages such as resistance to takedowns, the anonymity of blockchain transactions, and the ability to update payloads, with creating or modifying smart contracts typically costing less than $2 per transaction. Two weeks ago, Elliptic said North Korea had stolen cryptocurrency valued at more than $2 billion so far in 2025.