Creating or modifying smart contracts typically cost less than $2 per transaction, a huge savings in terms of funds and labor over more traditional methods for delivering malware.
Layered on top of the EtherHiding Google observed was a social-engineering campaign that used recruiting for fake jobs to lure targets, many of whom were developers of cryptocurrency apps or other online services. During the screening process, candidates must perform a test demonstrating their coding or code-review skills. The files required to complete the tests are embedded with malicious code.
Illustration of UNC5342 EtherHiding flow.
The infection process relies on a chain of malware that gets installed in stages. Later stages responsible for executing the final payloads are then installed through smart contracts that the hackers store on the Ethereum and the BNB Smart Chain blockchains, which accept uploads from anyone.
One of the groups Google observed, a North Korean-backed team tracked as UNC5342, uses earlier-stage malware tracked as JadeSnow to retrieve later-stage malware from both the BNB and Ethereum blockchains. The Google researchers observed:
It is unusual to see a threat actor make use of multiple blockchains for EtherHiding activity; this may indicate operational compartmentalization between teams of North Korean cyber operators. Lastly, campaigns frequently leverage EtherHiding’s flexible nature to update the infection chain and shift payload delivery locations. In one transaction, the JADESNOW downloader can switch from fetching a payload on Ethereum to fetching it on the BNB Smart Chain. This switch not only complicates analysis but also leverages lower transaction fees offered by alternate networks.
The researchers said they also observed another group, the financially motivated UNC5142, also employing EtherHiding.
North Korea’s hacking prowess was once considered low caliber. Over the past decade, the country has mounted a series of high-profile attack campaigns that demonstrate growing skill, focus, and resources. Two weeks ago, blockchain analysis firm Elliptic said the nation has stolen cryptocurrency valued at more than $2 billion so far in 2025.
