NullReceiver: New Ethereum-Based C2 Technique Hides IP in Recipient Addresses

Cybersecurity researchers have uncovered a new evolution of the EtherHiding blockchain-based command-and-control (C2) technique, dubbed NullReceiver, which conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The discovery was made by OpenSourceMalware, which identified two trojanized npm packages, bianira-ui and fluid-type-ui, leveraging this novel dead drop resolver approach.

Unlike EtherHiding, which embeds malicious code in smart contracts or transaction calldata, NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer. The malware looks up the attacker’s wallet, reads the destination address of its most recent outbound transaction, and decodes the C2 IP from those address bytes. This eliminates the fixed, watchable destination that made EtherHiding detectable, as each lookup uses a brand-new, throwaway address that has never been seen before.

The packages were published on July 28, 2026, and have been downloaded a few hundred times since then—bianira-ui (109 downloads) and fluid-type-ui (587 downloads). They are no longer available on npm. The activity has been linked to North Korea, which has previously used EtherHiding in campaigns like Contagious Interview, as detailed by Google Threat Intelligence Group (GTIG).

Security researcher Paul McCarty explained that NullReceiver addresses a major shortcoming of EtherHiding: the need for a fixed, publicly known destination address that can be tracked by defenders. By using a non-existent destination address that only serves to encode the C2 IP, attribution becomes more difficult. The technique also reduces costs, as the transfer is completely blank, making it the cheapest and least conspicuous transaction shape on the network.

The attack sequence involves looking up a hard-coded attacker wallet (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a), finding its most recent outbound transaction, reading the destination address, decoding the C2 IP from the first four bytes, and connecting to it (e.g., 166.88.134[.]62). An analysis of the wallet transactions shows the destination address 0xa658863ea658863e68656c6c6f6970626f742121, where a658863e decodes to the IP and the trailing bytes represent the ASCII string “helloipbot!!”.

NullReceiver represents a deliberate improvement on EtherHiding, making it harder for defenders to detect and attribute malicious activity. While it can only encode a few bytes, its stealth and low cost make it an attractive option for threat actors.