North Korean-affiliated cyber attackers have developed a novel method to obscure their malware command-and-control (C2) servers by embedding server addresses within empty Ethereum transactions. This technique, termed ‘NullReceiver,’ enables the malware to retrieve instructions from the blockchain, effectively camouflaging malicious activity as standard cryptocurrency transfers.
Security researchers identified this method in two malicious npm packages: bianira-ui version 1.27.0 and fluid-type-ui version 2.0.8. These packages impersonated legitimate Tailwind CSS plugins, posing significant supply chain risks for developers who might inadvertently incorporate them into their projects without thorough vetting.
The NullReceiver technique operates by extracting the recipient address from the latest outgoing transaction of an attacker-controlled Ethereum wallet. This recipient address is crafted so that specific bytes translate into the IP address of the malware’s C2 server. Notably, these transactions carry no monetary value and lack input data, allowing them to blend seamlessly into regular blockchain activity and evade detection by traditional security measures.
This approach differs from previous methods like ‘EtherHiding,’ where attackers stored command data within a transaction’s calldata or a smart contract. While NullReceiver carries limited information—primarily an IP address—it offers advantages such as reduced operational costs, less conspicuous on-chain presence, and avoidance of predictable destination addresses that defenders might monitor.
The implications for software supply chain security are profound. Malicious npm dependencies can infiltrate developers’ workstations, build systems, and software projects through routine installation processes. This underscores the necessity for developers to meticulously review dependency updates before deployment, scrutinize unexpected outbound blockchain RPC traffic, and monitor applications that inspect transaction recipient addresses.
To mitigate such threats, organizations should:
- Restrict unnecessary access to cryptocurrency RPC providers.
- Isolate machines that have installed the identified malicious packages.
- Rotate exposed developer credentials promptly.
These measures are crucial as North Korean cyber operations increasingly employ sophisticated techniques that exploit trusted software components rather than relying solely on software vulnerabilities.
The emergence of the NullReceiver technique highlights the evolving landscape of cyber threats, where attackers leverage decentralized technologies to enhance the resilience and stealth of their operations. This development underscores the importance of continuous vigilance and adaptation in cybersecurity practices to counteract innovative attack vectors.
