NullReceiver Advances EtherHiding with Blank Crypto Transfers

Summary

DPRK-linked threat actors are using a new blockchain-based C2 resolution method known as NullReceiver. The technique embeds C2 IP addresses within the recipient address bytes of zero-value Ethereum transfers, making detection more difficult than with traditional EtherHiding. The associated malware is distributed through trojanized npm packages.

Investigation

Researchers investigated the activity through static analysis of published npm tarballs and read-only examination of attacker-controlled transactions on the public blockchain. The analysis identified two malicious npm packages, bianira-ui and fluid-type-ui, that use NullReceiver to resolve command-and-control infrastructure.

Mitigation

Defenders should monitor blockchain activity associated with known attacker-controlled Ethereum wallets and inspect recipient addresses used in zero-value transfers. Organizations should also strengthen software supply chain controls for npm dependencies to prevent the installation of trojanized packages.

Response

If NullReceiver activity is detected, affected Node.js environments should be isolated immediately. Investigators should identify the source of the malicious npm package and block the associated C2 IP addresses and Ethereum wallet addresses at both network and application layers.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to establish a stealthy C2 channel that bypasses traditional IP-based blacklisting. To do this, they deploy a malicious npm package that uses the “NullReceiver” technique. The script initializes global variables using specific obfuscated syntax (global.i = "A10-npm3!", global.r = require) and immediately reaches out to the https://1rpc.io/eth endpoint. This allows the malware to read the “recipient” field of a specific Ethereum transaction, which contains the encoded IP address of the actual C2 server. This method uses legitimate blockchain infrastructure to hide malicious intent.

• Regression Test Script:

  #!/bin/bash
  # Simulation script for NullReceiver C2 Technique detection
  
  # Create a malicious node script that mimics the specific patterns in the detection rule
  cat << 'EOF' > malicious_npm_payload.js
  // Mimicking the exact patterns defined in the Sigma rule
  global.i = "A10-npm3!"; 
  global.r = require;
  
  const https = require('https');
  
  // The malware reaches out to the specific RPC endpoint to fetch instructions
  const url = 'https://1rpc.io/eth';
  
  console.log("[!] Initiating blockchain-based C2 lookup...");
  
  https.get(url, (res) => {
    console.log("[!] Connection successful. Analyzing blockchain state...");
    res.on('data', (d) => {
      // In a real attack, this would parse the 'recipient' field for the C2 IP
      console.log("[!] Instruction received via NullReceiver technique.");
    });
  }).on('error', (e) => {
    console.error(`[X] Connection failed: ${e.message}`);
  });
  EOF
  
  # Execute the malicious script using node
  echo "[*] Running malicious simulation..."
  node malicious_npm_payload.js
  
  # Clean up the script file
  rm malicious_npm_payload.js

• Cleanup Commands:

  # Remove any artifacts created during simulation
  rm -f malicious_npm_payload.js