DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Written by: Blas Kojusner, Robert Wallace, Joseph Dobson Google Threat Intelligence Group (GTIG) has observed the North Korea (DPRK) threat actor UNC5342 using ‘EtherHiding’ to deliver malware and facilitate cryptocurrency theft, the first time GTIG has observed a nation-state actor adopting this method. This post is part of a two-part blog series on adversaries using EtherHiding , a technique that leverages transactions on public blockchains to store and retrieve malicious payloads—notable for