New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware

Written by: Mark Magee, Jose Hernandez, Bavi Sadayappan, Jessa Valdez Since late 2023, Mandiant Threat Defense and Google Threat Intelligence Group (GTIG) have tracked UNC5142, a financially motivated threat actor that abuses the blockchain to facilitate the distribution of information stealers (infostealers). UNC5142 is characterized by its use of compromised WordPress websites and "EtherHiding " , a technique used to obscure malicious code or data by placing it on a public blockchain, such as