Hackers’ “bullet-proof” hosts deliver malware from blockchains

Hacking groups, including one reportedly linked to the North Korean government, have discovered a novel and cost-effective method for distributing malware. This technique involves utilizing public cryptocurrency blockchains as 'bullet-proof' hosts. In a recent update, the Google Threat Intelligence Group detailed how this strategy allows hackers to create their own secure hosting environments, largely insulated from law enforcement actions and the scrutiny of cybersecurity experts. Typically, these bullet-proof hosts are based in jurisdictions that lack extradition treaties with the United States and other countries, making takedowns difficult. Criminals often pay significant fees for these services, which cater to a variety of illicit activities, including the distribution of malware and other illegal content. Since February, Google researchers have identified two hacking groups employing a technique known as EtherHiding. This method embeds malware within smart contracts—self-executing agreements that operate on Ethereum and other blockchains. When parties to the contract meet predefined conditions, the smart contracts automatically enforce the terms, creating a system that is theoretically immutable and free from central authority oversight. Researchers Blas Kojusner, Robert Wallace, and Joseph Dobson noted that EtherHiding marks a significant evolution in malware delivery methods, exploiting the unique features of blockchain technology for malicious purposes. This innovative approach highlights the ongoing adaptation of cyber threats as attackers leverage emerging technologies to enhance their operations. EtherHiding offers substantial advantages over traditional malware delivery methods, which often depend on compromised servers and other less resilient infrastructures.