A sophisticated new method for hiding malware communication channels has emerged, leveraging the blockchain to outmaneuver conventional security tools. Researchers have identified a technique they've dubbed "NullReceiver," which uses empty Ethereum transactions as a covert routing service for command-and-control (C2) servers, marking an evolution from earlier blockchain-based evasion tactics.
The technique was observed in two trojanized npm packages, bianira-ui and fluid-type-ui, which are reportedly linked to North Korean threat actors and masqueraded as common user interface libraries. Upon installation, the malicious code executes a novel "dead drop resolver." Instead of containing a C2 address in a traditional config file or HTTP response, it constructs a zero-value Ethereum transaction. The IP address of the attacker's server is then encoded directly into the mandatory recipient address field of this transfer.
This represents a significant stealth advancement over the previous "EtherHiding" method. Earlier approaches stored C2 data in the optional data payload of blockchain transactions—a space that security tools could easily scan and flag. By moving the resolver into the non-negotiable destination address of a valueless transaction, NullReceiver bypasses static payload analysis and leaves no financial trail. The public blockchain ledger is effectively weaponized as an immutable, decentralized dead drop.
The discovery highlights a critical shift in the threat landscape and the limitations of traditional defense. Signature-based scanning and known indicator-of-compromise (IoC) matching are rendered ineffective against this method. Security strategies must therefore pivot toward runtime behavioral monitoring and dynamic analysis. The primary defensive question is no longer "what does the code look like?" but rather "what unexpected network activity is the code initiating?"
To combat this and similar evasion techniques, organizations must adopt a new defensive posture. Recommended actions include implementing strict runtime allow-lists for API and network endpoints, treating any unexpected outbound traffic from application servers to cryptocurrency node RPCs as a high-severity alert, and sandboxing all unverified dependencies before deployment. The core principle is to assume all dependencies are potentially hostile until their runtime behavior is validated.
Several questions about the campaign remain open. Technical specifics, such as the precise algorithm used to compress a four-byte IPv4 address into a twenty-byte Ethereum address format, have not been detailed. It is also unclear whether the activity targeted the Ethereum mainnet, testnets, or layer-two networks. Furthermore, the security researcher or firm responsible for discovering and naming the NullReceiver vector has not been publicly credited.
Ultimately, this incident serves as a stark reminder for development and security teams. As attackers increasingly leverage decentralized infrastructure to build resilient, stealthy C2 channels, defense must evolve accordingly. Continuous dependency auditing, strict supply chain governance, and a focus on monitoring runtime behavior over static code review are now essential for protecting modern applications.
一種利用區塊鏈技術避開傳統安全工具的精密新方法現身，研究人員將其命名為「NullReceiver」。此技術將空白以太坊交易用作指令與控制（C2）伺服器的隱蔽路由服務，代表了區塊鏈規避策略的重大演進。
研究人員在兩個木馬化npm套件bianira-ui及fluid-type-ui中發現此技術，據報這些套件與北韓威脅行為者有關，並偽裝成常見的使用者介面庫。安裝後，惡意代碼會執行一種新型「死信傳遞解析器」。它並非在傳統設定檔或HTTP回應中嵌入C2位址，而是構建一筆零價值的以太坊交易，並將攻擊者伺服器的IP位址直接編碼到該筆轉帳的強制接收位址欄位中。
相較於先前的「EtherHiding」方法，此技術在隱蔽性方面實現了重大突破。早期做法將C2數據存儲在區塊鏈交易的可選data載入區——該區域易被安全工具掃描標記。NullReceiver將解析功能轉移至無價值交易的不可協商目標位址，從而繞過靜態載入分析且不留下財務軌跡。公開的區塊鏈帳本實際上被武器化為不可變、去中心化的死信傳遞點。
此次發現揭示了威脅態勢的關鍵轉變及傳統防禦的局限性。基於特徵碼的掃描與已知危害指標（IoC）匹配對此方法無效。因此安全策略必須轉向運行時行為監控與動態分析。主要防禦問題不再是「代碼長什麼樣？」，而是「代碼正在發起哪些非預期的網路活動？」
為應對此類規避技術，組織必須採取新的防禦姿態。建議措施包括：實施嚴格的API與網路端點運行時白名單；將應用伺服器至加密貨幣節點RPC的任何非預期外傳流量視為高嚴重度警報；以及在部署前對所有未經驗證的依賴項進行沙盒隔離。核心原則是假定所有依賴項皆具潛在敵意，直至其運行時行為得到驗證。
關於此攻擊活動的若干問題仍待釐清。技術細節尚未詳述，例如將四位元組IPv4位址壓縮至二十位元組以太坊位址格式的具體演算法。目前亦不明確該活動是以太坊主網、測試網還是第二層網路為目標。此外，發現並命名NullReceiver向量的安全研究員或公司尚未公開致謝。
此事件最終為開發與安全團隊敲響警鐘。隨著攻擊者日益利用分散式基礎設施建構具韌性且隱蔽的C2通道，防禦手段必須相應演進。持續性的依賴項審計、嚴格的供應鏈治理，以及著重監控運行時行為而非靜態代碼審查，現已成為保護現代應用程式的必要措施。