North Korea Exploits Blockchain for Covert Hacks, Disguising as Job Recruiters

North Korea Exploits Blockchain for Covert Hacks, Disguising as Job Recruiters

Summary:
A North Korean hacking group, known as Famous Chollima, is strategically using blockchain technology to hide malware within smart contracts. This practice, termed "EtherHiding," presents a novel tactic where cybercriminals target job seekers through fake recruitment processes, deploying malware that captures cryptocurrency and personal credentials.

Key Takeaways

North Korean hackers are using blockchain technology to conceal malware in smart contracts, marking the first use of EtherHiding by a state actor.
Their tactics include creating fake job applications and interviews to introduce malware to victims.
Recent attacks have involved sophisticated malware that can log keystrokes and capture screenshots.
The hackers employ legitimate-looking companies using false identities to enhance their credibility.
These operations have resulted in the theft of over $3.5 billion in cryptocurrency in recent years, which funds the North Korean weapons program.

The Rise of EtherHiding: A New Threat

The North Korean cyber threat group Famous Chollima has begun utilizing blockchain technology to hide malicious code within smart contracts. This represents the first known instance of a nation-state actor employing "EtherHiding" methods. Security firms, including Cisco Talos and Google Threat Intelligence, have confirmed that these attacks primarily target job seekers through counterfeit interviews, delivering malware designed to steal cryptocurrencies and personal login credentials.

The attackers have introduced a new JavaScript module that incorporates BeaverTail and OtterCookie malware, possessing capabilities like keystroke logging and screenshot capturing. This malicious software was hidden within a Node.js package called "node-nvm-ssh" and masqueraded as a chess application named "Chessfi."

North Korea Exploits Blockchain for Covert Hacks, Disguising as Job Recruiters
Node-nvm-ssh infection path | Source: Cisco Talos

Researchers have identified a specific North Korean group, UNC5342, embedding JADESNOW malware and INVISIBLEFERRET backdoors into smart contracts on both the BNB Smart Chain and Ethereum since February 2025.

North Korea Exploits Blockchain for Covert Hacks, Disguising as Job Recruiters
UNC5342 EtherHiding on BNB Smart Chain and Ethereum | Source: Google Cloud

By storing malicious payloads on public blockchains, these attackers create a decentralized command-and-control infrastructure that remains impervious to law enforcement intervention. This development follows North Korean hackers stealing over $1.3 billion from 47 incidents in 2024 and an astonishing $2.2 billion in just the first half of 2025, largely funding the regime's weapons endeavors via elaborate money laundering schemes.

Understanding EtherHiding: Reinventing Malicious Hosting

EtherHiding embeds malicious JavaScript payloads within public blockchain smart contracts, effectively transforming decentralized ledgers into resilient command-and-control servers. Attackers can retrieve these payloads using function calls that do not incur transaction fees, resulting in no observable blockchain history.

This technique provides decentralized storage, impedes takedowns, and obscures the identity of attackers through pseudonymous transactions. Additionally, the immutability of smart contracts makes it challenging to remove the malicious content.

Famous Chollima employed EtherHiding in a campaign dubbed "Contagious Interview," where they impersonate entities like Coinbase and Robinhood as recruiters. Victims often download infected files from GitHub repositories during ostensibly technical evaluations, initiating multi-stage infection processes.

The JADESNOW downloader manages to query the BNB Smart Chain via API services like Binplorer to pull payloads from a specific smart contract address (0x8ea**8a71c). This contract has seen over 20 updates in just four months, with each update costing approximately $1.37 in gas fees.

North Korea Exploits Blockchain for Covert Hacks, Disguising as Job Recruiters
On-chain transactions | Source: Google Cloud

Investigations into blockchain transactions reveal on-chain data containing encoded messages that decrypt to heavily obfuscated JavaScript payloads. The malware tends to navigate across networks, utilizing Ethereum transaction histories through various explorer APIs such as Blockchair and Ethplorer.

The final malicious payload, INVISIBLEFERRET.JAVASCRIPT, establishes connections to command-and-control servers via port 3306, relaying victim data such as hostname, username, operating system, and current directory. The backdoor enables arbitrary command executions, file extractions, and directory scanning while concurrently targeting over 80 browser extensions, including MetaMask and Phantom.

Functional similarities between Famous Chollima tools | Source: Cisco Talos

Deceptive Identities and Fraudulent Companies

Earlier this year, it became evident that North Korean operatives had created legitimate American corporations under fictitious identities to establish credible business fronts. For instance, researchers from Silent Push uncovered a company named Blocknovas registered on a vacant plot in South Carolina, while another firm, Softglide, traced back to a tax office in Buffalo.

These companies spearheaded the "Contagious Interview" initiative, which is a subgroup of the Lazarus Group focused on malware deployment. Cryptocurrency investigator ZachXBT has recorded at least 25 cases of North Korean IT operatives infiltrating crypto firms, utilizing over 30 fake identities supported by government-issued identification and professional LinkedIn profiles.

A compromised device exposed systematic documentation of expenses tied to the purchase of Social Security numbers, professional accounts, and VPN services. Recently, Binance's founder Changpeng Zhao issued a warning regarding four primary attack vectors attributed to these hackers, which include fake job applications, fraudulent interviews laden with malware, customer support scams, and bribery tactics targeting employees or outsourced vendors.

"These North Korean hackers are advanced, creative, and patient. They often pose as job candidates to infiltrate companies, eyeing roles in development, security, or finance," remarked Zhao. He also referenced a significant hack of an Indian outsourced service that compromised U.S. exchange user data, culminating in losses exceeding $400 million.

Cisco Talos documented instances of Famous Chollima generating fraudulent skill-assessment platforms that closely mimic legitimate company evaluation systems through their PylangGhost malware campaign. Victims frequently complete technical assessments by downloading what they believe are video drivers, which actually contain malicious Python payloads.

Efforts to combat these sophisticated attackers are ongoing, with U.S. authorities recently seizing over $7.7 million in cryptocurrencies allegedly obtained through clandestine networks of IT operatives.