EtherHiding: when blockchain technology becomes a cyber weapon

Preamble

In the cybercrime world, a strange cat and mouse game is continuously taking place. Cybersecurity researchers tirelessly hunt attackers' infrastructures. As soon as some of their components are discovered and brougth to light, they quickly become obsolete because of their addition on IOC's lists that strengthen cybersecurity equipments. This is why attackers must be able to constantly adapt themselves.

We can make an analogy with a spy : as soon as we see right though him, he becomes straight useless. Therefore, malicious actors have mainly two needs to satisfy :

• Operate silently in order to delay their detection. Indeed, campaigns' biggest effects are expected to occur mainly during the first few days.
• Be resilient to maintain strike capacity despite adversaries' coutermeasures. Command and Control (C2) servers must remain active as long as possible. Attackers must be flexible enough to adapt if some of their servers get blocked, while minimizing human and material resources involved.

The "EtherHiding" technique emerged to address these challenges. The principle behind it is for attackers to exploit blockchain technology to store some components of their infrastructures. Involved nodes are distributed across different geographical locations, without being managed by a single entity or organization. It makes the blocks impossible to remove through external requests. Moreover, this makes any detection more difficult, as traffic is redirected towards legimitate nodes rather than a C2 server. Finally, since the blockchain acts as an immutable intermediary between the victim and the criminal group, the latter can more easily reshape its infrastructures without having to modify anything on the victim's side.

This technique, theorized in the late 2010s, came out loudly in 2023 with a campaign attributed to the UNC5142 group. Since its emergence the same year, the group has adopted this approach to deploy infostealers against victims. Similar operations have also been frequently observed since then. While the used blockchain and the operational methods may vary, the underlying strategy remains the same for now.

However, this new technique is not without drawbacks for attackers. It provides to analysts new opportunities for tracking, as well as coutermeasures possibilities. Finally, although traffic dissumulation helps evading detection, solutions exist to protect ourselves against this threat.

The EtherHiding technique

The smart contract

At the core of EtherHiding technique, attackers place some data within a smart contract. In the blockchain ecosystem, a smart contract is a computer program that verifies and executes an agreement. It contains an address, an immutable source code, and a dedicated data space that evolves through future blocks added as a result of transactions recorded on the blockchain. It is mainly within this storage area that attackers deploy information such as :

• A C2 server address.
• A payload to be injected.

The ability to update this data through new blocks allows criminal groups to reshape their attacks at any time. To do so, they simply need to carry out transactions that modify the storage area on their smart contracts.

How does the victim interact with these contracts? In the observed campaigns so far, this interaction mainly occurs through legitimate web pages that have been compromised by attackers. They inject an additional script that sends a request to the smart contract in order to retrieve the data. To achieve this, attackers rely on Blockchain Infrastructure Platform (BIP) services. These entities host nodes for various blockchains and allow their customers to interact with them through a set of functions. Between these entities we can find Alchemy, Ankr or Quicknode. They are, therefore, entirerly legitimate. They often generate revenue by charging their customers for transactions carried out on the blocks, as well as function calls made to smart contracts.

One of these functions is actually widely used in EtherHiding technique, it is eth_call. This function makes it possible to call a contract in order to retrieve information from it. It can be used from a JavaScript script through a simple POST request. This allows the contract to be contacted directly through its address. In most cases, an API key must also be included as a parameter so that the BIP can authenticate the client's request.

Example of an eth_call function call in a JavaScript script

const body = {

jsonrpc: "2.0",
method: "eth_call",
params: [{

to: CONTRACT,
data: DATA

}, "latest"],
id: 1

};

const r = await fetch(RPC_URL, {

method: "POST",
body: JSON.stringify(body)

});

The eth_call function is also embedded in some libraries such as ethers.js, viem, web3.js. These libraries may therefore sometimes be found within the injected script. The collected data is then used by the script. Several use cases have been observed, some of which are complementary.

Use case: the C2 link

In this scenario, the most recent version of the data consumed by the smart contract contains the configuration required to connect to a criminals' Command and Control server. The contract's call can return, among other things, a URL, a port number, an encryption key, a configuration... Once retrieved by the script, this information is used to send requests to the C2 server which will be used for the continuation of the attack. Here, the smart contract acts as a directory, allowing the attacker to redirect the victim to his Command and Control server. While this does not make the attacker undetectable, it does increase his resiliency. Even if the C2's IP addresses and URLs get blocked, the contract itself remains operationnal. The attacker only needs to update the contract's data to relaunch the operation.

Figure 1: Illustration of a smart contract returning a C2 server's address

Use case: the webpage modification

In this case, the smart contract's data return HTML/JavaScript code that the script displays in an overlay window on top of the original web page (an iframe). This overlay indicates fake error messages or fake CAPTCHA prompts, designed to trick them into entering malicious commands (a technique commonly known as Clickfix) to prepare the next stage of the attack. It is worth noting that the smart contract may return the malicious code itself or redirect the victim to a C2 server that hosts the malicious page, as described in the previous section.

Figure 2: Illustration of a smart contract directly returning a payload

Use case: the proxy pattern

In blockchain-based infrastructures, the proxy pattern is a design that separates request routing from business logic. In practice, this involves using a front-facing smart contract used as the initial point of contact with external entities. Its role is to redirect requests to other smart contracts for executing the underlying logic.

For attackers, the main advantage of this approach is the ability to dynamically adapt their operations by deploying new smart contracts that replace older ones. It also allows them to create multiple contracts, each of them dedicated to a specific function. The UNC5142 campaign observed in November 2024 is an interesting example of this approach.

Its workflow was as follows:

• The injected JavaScript connects to the first proxy contract. This proxy returns the address of a second smart contract.
• The script then contacts the second smart contract sending its system information. This information is used both for telemetry purpose and to obtain the address of a third smart contract based on the victim's profile.
• The script contacts the third smart contract, which returns a payload to the victim, customized for their profile.

Figure 3: Illustration of a proxy pattern

Chronology

Since its emergence in late 2023, several campaigns using the EtherHiding technique have been discovered. The differences between these campaigns vary depending on the operation but the underlying principle remains the same. However, we have observed temporal markers in the largest operations and in the variations of the employed techniques:

• September 2023: Start of the UNC5142 group's campaign ClearFake.
  • This is the first observed large-scale use of this technique.
  • The initial goal is to trick the victim into downloading a fake browser update.
  • The campagin is based on the Binance Smart Chain (BSC) blockchain.
• May 2024: First variation of the ClearFake campaign which now performs ClickFix through fake browser error messages.
• November 2024: ClearFake campaign uses the proxy pattern as a new design. This is the three-contract architecture described in the previous section.
• December 2024: New trick spotted in the ClearFake campaign : the ClickFix technique is used through a fake reCAPTCHA.
• February 2025: the North Korean group UNC5342 launches a campaign using the Jadesnow malware.
  • The payload returned by the smart contract is a variant of InvisibleFerret, one of whose objectives is to steal cryptocurrencies.

A technique with drawbacks

As discussed above, this technique offers several significant advantages for attackers. Indeed, decentralized blocks cannot be deleted. There is also the case of the Blockchain Infrastructure Plarforms (BIP), which criminals groups use for interactions between victims and smart contracts. Authorities could, in theory, take actions against these services to make them delete the cybercriminals accounts. However, these procedures may be lengthy and uncertain, depending on the country where these BIPs are based. These countries cooperation levels could vary widely.

However, this technique is not without drawbacks for threat actors. By design, the information stored on the blockchain is public and immutable. Using blockchain explorers, analysts can access to this data as well as artifacts that may help them identify the attackers. As a result, it is possible to monitor their transactions and activities in real time.

Moreover, the code and the data stored in smart contracts remain accessible after decryption. Therefore, if C2 servers are used, they can be located here. Similarly, the payloads can be analyzed, and victim's telemetry is readable. For the contract code, it is even possible to use it as pivot to uncover similar smart contracts. In this way, a lot of attacker's infrastructures can be discovered.

Finally, to make calls to the smart contract functions, most of the BIP services require an API key to identify and authenticate the client. Therefore, in some scripts injected into compromised web pages, the attackers' API keys can be found in the eth_call function call. As a reminder, most of BIP services charge their customers for these calls or limit the number of possible calls. Once in possession of these keys, it becomes theorically possible to consume all the attackers' credit. While legal restrictions apply, not everyone is equally scrupulous...

How to protect ourselves?

The main challenge in detecting these attacks is made by the legitimate aspect of the connections to blockchain nodes. So what can we do?

For organizations, it starts with the following question: "As part of our operations, do our employees need to use functions that interact with the BlockChain?". If not, it may be interesting to detect these attempts et to block them at the network level, and to detect and block them at a host level if detected in a script.

In order to interact with a smart contract, the eth_call naturally comes to mind, but another function can be used, allowing to read the contrat's storage: eth_getStorageAt. However, these functions may not appear directly in a script but rather in an imported third-party library such as ethers.js or viem. So their presence may be considered suspicious in this context. Finally, the web3.js library allows to interact with a contrat through the eth.Contract object.

On Stormshield Network Security (SNS) firewalls, a dedicated IPS protection helps you detect websites calling a smart contract : http:javascript:stack.519 - Web: Data retrieval attempt from a smart contract's data by a web page

By default, this rule is enabled in blocking mode only on the SNS "High" profile. We recommand that you enable it only if your organization has no special connection to the blockchain ecosystem.

Finally, since a lot of these campaigns include a ClickFix part : it can be useful to train employees about this threat, so that they do not become the next victims.

MITRE ATT&CK

Conclusion

This EtherHiding technique is a good example of attackers' adaptation trials to improve their resiliency, through legitimate and unbreakable infrastructures's components. Therefore, it perfectly fits in an advanced attack scenario.

New campaigns employing this strategy are periodically identified by cybersecurity analysts. It is highly likely that it will persist, with new ways of designing and deploying their smart contracts. This technique is not invisible either: the very nature of blockchain technology makes it possible to track threat actors' activities and to analyse them.