Cybersecurity researchers have identified an advanced variant of the EtherHiding technique that conceals command-and-control server IP addresses within fake Ethereum transaction recipient addresses. Two malicious npm packages, 'bianira-ui' and 'fluid-type-ui,' were discovered using this 'NullReceiver' method, which leverages empty Ethereum transfers as a dead drop resolver mechanism to evade detec
Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm package "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
