NullReceiver Uses Blockchain for Stealth

A sophisticated evolution in blockchain-based command-and-control tactics has emerged, moving beyond established methods of obfuscation. Researchers have identified a technique dubbed NullReceiver, which facilitates communication between infected systems and attacker servers by embedding IP addresses within the destination fields of seemingly benign Ethereum transactions.

Refining the EtherHiding Technique

The NullReceiver approach represents a technical pivot from the previously documented EtherHiding method. While original implementations of blockchain-based C2 relied on embedding malicious scripts or data within the calldata of a smart contract, the new method avoids these indicators entirely by using the recipient address itself as an encoder for the C2 server's IP address.

Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer.

— Paul McCarty, security researcher

By utilizing a zero-value, zero-data transfer, the attackers ensure that the transaction appears as an empty movement on the blockchain. This removes the necessity of a fixed, watchable destination address that security researchers could otherwise track for repeat activity.

Supply Chain Compromise via npm

The technique was uncovered within two malicious npm packages, bianira-ui and fluid-type-ui, which have since been removed from the registry. These libraries acted as the delivery vehicle, executing a sequence that queries a hard-coded wallet address to identify the most recent outbound transaction and subsequently decoding the C2 IP from the first four bytes of that transaction's recipient field.

• bianira-ui: 109 downloads
• fluid-type-ui: 587 downloads
• Total transactions observed: 68
• Campaign start date: July 27, 2026

Operational Efficiency and Stealth

NullReceiver provides significant operational benefits to the threat actors, primarily through cost reduction and improved anonymity. Because the transactions contain no extra data fields, the attackers avoid the gas fees typically associated with storing payloads in calldata. Furthermore, the use of throwaway destination addresses for every lookup prevents the creation of a consistent fingerprint that could be flagged by defensive monitoring tools.

Implications for Network Security

The transition toward more ephemeral, stealth-oriented C2 channels suggests an increasing focus on evading automated blockchain monitoring. For security teams, this shift complicates the detection of malicious activity, as the traffic no longer relies on recognizable smart contract patterns or embedded payloads. Organizations should recognize that even empty blockchain transactions can potentially serve as indicators of compromise, and that software supply chain integrity remains a primary vector for these advanced communication techniques.