North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts

According to Google Threat Intelligence Group, a North Korea-linked threat actor has been observed using EtherHiding to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored group has embraced this method. The activity is attributed to UNC5342, a cluster also known as CL-STA-0240 (Palo Alto Networks Unit 42) and several other names used by security vendors.

The attack wave is part of the Contagious Interview campaign, where attackers approach targets on LinkedIn as recruiters and shift conversations to Telegram or Discord before delivering malicious code. Google said EtherHiding embeds nefarious code within a smart contract on a public blockchain and can be updated by the attacker controlling the contract, with an average gas cost of $1.37.

The infection chain is multi-stage, targeting Windows, macOS, and Linux with three malware families, including BeaverTail, JADESNOW, and InvisibleFerret, and also involving an initial downloader via npm packages. Robert Wallace of Mandiant, Google Cloud, described the development as an escalation in the threat landscape.