North Korean Hackers Using EtherHiding to Evade Detection

North Korean hackers have adopted a sophisticated new technique called EtherHiding to evade cybersecurity defenses and conduct stealthy cyber espionage. This method leverages the Ethereum blockchain to conceal malicious activities, making detection and attribution significantly more challenging for security professionals. The use of blockchain technology by threat actors marks a concerning evolution in cyberattack strategies, as it exploits decentralized and encrypted platforms to mask command-and-control communications and payload delivery. EtherHiding allows attackers to embed malicious code within Ethereum transactions, effectively hiding their tracks in a way that traditional security tools struggle to detect. This technique complicates incident response efforts and demands advanced threat intelligence and blockchain analysis capabilities. Security teams must adapt to this emerging threat by enhancing their monitoring of blockchain networks and integrating blockchain forensic tools into their cybersecurity frameworks. The rise of EtherHiding underscores the importance of continuous innovation in cybersecurity defenses. Organizations should prioritize threat hunting and invest in training to recognize blockchain-based attack vectors. Collaboration between cybersecurity firms, blockchain experts, and law enforcement agencies is crucial to counteract these advanced persistent threats. As North Korean hackers continue to refine their tactics, the cybersecurity community must stay vigilant and proactive to protect critical infrastructure and sensitive data from these evolving threats.

This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 17 Oct 2025 08:35:21 +0000


Cyber News related to North Korean Hackers Using EtherHiding to Evade Detection

North Korea's state hackers stole $3 billion in crypto since 2017 - North Korean-backed state hackers have stolen an estimated $3 billion in a long string of hacks targeting the cryptocurrency industry over the last six years since January 2017. Kimsuky, Lazarus Group, Andariel, and other North Korean hacking groups ...
2 years ago Bleepingcomputer.com Andariel Kimsuky Lazarus Group
North Korean Hackers Use EtherHiding to Evade Detection in Cyber Espionage Campaign - North Korean hackers have adopted a sophisticated technique called EtherHiding to evade detection in their cyber espionage campaigns. This method allows them to conceal malicious activities within legitimate network traffic, making it harder for ...
2 months ago Thehackernews.com North Korean hackers
Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks - Microsoft has identified a new North Korean threat actor, now tracked as Moonstone Sleet, that uses both a combination of many tried-and-true techniques used by other North Korean threat actors and unique attack methodologies to target companies for ...
1 year ago Microsoft.com
North Korean IT worker scam is now a threat to all companies, cybersecurity experts say | The Record from Recorded Future News - Since disruptions began last year and law enforcement has publicly warned companies of the practice, DTEX’s Barnhart and others said they have seen some workers try to extort companies or hand off their access to more sophisticated North Korean ...
7 months ago Therecord.media
North Korean Hackers Use Fake Job Offers & Salary Bumps as Lure for Crypto Theft - Recent investigations have uncovered a massive operation carried out by North Korean hackers looking to steal cryptocurrency through fake job offers and salary bumps. According to recent reports, hackers have been able to trace the malicious ...
2 years ago Therecord.media
North Korean Hackers Utilizing Credential Stuffing to Launch Cyberattacks - In an alarming new report, researchers found that North Korean-linked hackers have been using stolen passwords during cyberattacks to gain access to various government, military and financial networks. According to security experts, the creative ...
2 years ago Thehackernews.com
U.S DoJ Announces Nationwide Actions to Combat North Korean Remote IT Workers - The U.S. Department of Justice announced coordinated nationwide law enforcement actions on June 30, 2025, targeting North Korean remote information technology workers’ illicit revenue generation schemes that have defrauded American companies ...
5 months ago Cybersecuritynews.com
North Korean Hackers Using EtherHiding to Evade Detection - North Korean hackers have adopted a sophisticated new technique called EtherHiding to evade cybersecurity defenses and conduct stealthy cyber espionage. This method leverages the Ethereum blockchain to conceal malicious activities, making detection ...
2 months ago Cybersecuritynews.com North Korean hackers
Reserachers Uncovered North Korean Nationals Remote IT Worker Fraud Scheme - In a significant cybersecurity investigation, researchers have revealed an elaborate fraud scheme orchestrated by North Korean nationals who used stolen identities to secure remote IT positions at US-based companies and nonprofits. The operation ...
7 months ago Cybersecuritynews.com
North Korean IT worker army expands operations in Europe - GTIG's report follows multiple warnings issued by the FBI regarding North Korea's massive army of IT workers sent abroad to generate revenue, who have tricked hundreds of companies in the United States and worldwide into hiring them over the years. ...
8 months ago Bleepingcomputer.com
macOS Malware Mix & Match: North Korean APTs Stir Up Fresh Attacks - North Korean advanced persistent threat groups are mixing and matching components of two recently unleashed types of Mac-targeted malware to evade detection and fly under the radar as they continue their efforts to conduct operations at the behest of ...
2 years ago Darkreading.com
North Korea's Kimsuky Attacks Rivals' Trusted Platforms - North Korea-linked threat groups are increasingly using living-off-the-land (LotL) techniques and trusted services to evade detection, with a recent Kimsuky campaign showcasing the use of PowerShell scripts and storing data in Dropbox folders, along ...
10 months ago Darkreading.com Andariel Kimsuky
North Korean Hackers Stole $600m in Crypto in 2023 - North Korean hackers stole at least $600m in cryptocurrency in 2023, around a third of the total value of such heists, according to blockchain intelligence firm TRM. Despite the eye-watering sum, this figure represents a 30% reduction on ...
1 year ago Infosecurity-magazine.com
US govt sanctions North Korea's Kimsuky hacking group - The Treasury Department's Office of Foreign Assets Control has sanctioned the North Korean-backed Kimsuky hacking group for stealing intelligence in support of the country's strategic goals. OFAC has also sanctioned eight North Korean agents for ...
2 years ago Bleepingcomputer.com Andariel Kimsuky
Woman Accused of Helping North Korean IT Workers Infiltrate Hundreds of US Firms - The US government has announced charges, seizures, arrests and rewards as part of an effort to disrupt a scheme in which North Korean IT workers infiltrated hundreds of companies and earned millions of dollars for North Korea. According to the ...
1 year ago Securityweek.com
FBI Charges North Korean Hackers Over $100 Million Stolen in Crypto Hack - The FBI has recently charged a North Korean hacker in connection with the Harmony crypto hack from which the hacker allegedly stole over $100 million. The hacker, Jon Chang Hyok, is a member of the North Korean military intelligence agency, the ...
2 years ago Bleepingcomputer.com
Experts from the United Nations Report North Korean Hackers Have Taken a Large Amount of Digital Assets - Last year, North Korean hackers working for the government stole a record-breaking amount of virtual assets estimated to be worth between $630 million and more than $1 billion, according to a new report from U.N. experts. The panel of experts said ...
2 years ago Securityweek.com Andariel Kimsuky Lazarus Group Rocke
US hits senior North Korean officials with sanctions, $3 million bounties | The Record from Recorded Future News - U.S. law enforcement action centered on Korea Sobaeksu Trading Company — a North Korean company allegedly used as a front for the country’s Munitions Industry Department, which oversees the DPRK’s nuclear program and is involved in the ...
5 months ago Therecord.media
SharkStealer Using EtherHiding Pattern to Evade Detection - SharkStealer, a notorious information-stealing malware, has adopted a sophisticated evasion technique known as the EtherHiding pattern to avoid detection by security solutions. This advanced method allows the malware to conceal its network traffic ...
2 months ago Cybersecuritynews.com
Microsoft: BlueNoroff hackers plan new crypto-theft attacks - Microsoft warns that the BlueNoroff North Korean hacking group is setting up new attack infrastructure for upcoming social engineering campaigns on LinkedIn. This financially motivated threat group also has a documented history of cryptocurrency ...
2 years ago Bleepingcomputer.com
The past year was the most detrimental for digital currency security breaches, with North Korean organizations profiting. - In 2022, cyberattacks on cryptocurrency platforms resulted in the theft of almost $4 billion, with a large portion of the activity being attributed to hackers working on behalf of the North Korean government. According to blockchain research firm ...
2 years ago Therecord.media Lazarus Group
US seizes Sinbad crypto mixer used by North Korean Lazarus hackers - The U.S. Department of the Treasury has sanctioned the Sinbad cryptocurrency mixing service for its use as a money-laundering tool by the North Korean Lazarus hacking group. A cryptocurrency mixer is a server that allows people to deposit crypto, ...
2 years ago Bleepingcomputer.com Lazarus Group
North Korean Remote IT Workers Added New Tactics and Techniques to Infiltrate Organizations - North Korean state-sponsored remote IT workers have significantly evolved their infiltration tactics, incorporating artificial intelligence tools and sophisticated deception techniques to penetrate organizations worldwide. Microsoft researchers ...
5 months ago Cybersecuritynews.com
Microsoft links North Korean hackers to new FakePenny ransomware - Microsoft has linked a North Korean hacking group it tracks as Moonstone Sleet to FakePenny ransomware attacks, which have led to millions of dollars in ransom demands. While this threat group's tactics, techniques, and procedures largely overlapped ...
1 year ago Bleepingcomputer.com Kimsuky Lazarus Group LockBit Ransomhub
Microsoft: North Korean hackers join Qilin ransomware gang - Microsoft says Moonstone Sleet hackers are targeting both financial and cyberespionage targets using trojanized software (e.g., PuTTY), custom malware loaders, malicious games and npm packages, and fake software development companies (e.g., C.C. ...
9 months ago Bleepingcomputer.com Qilin