From Bulletproof to Blockchain: The Rise of EtherHiding

Transcript

Hey folks, I am Joe Dobson and I come from a company called Mandant. Um, if you haven't heard of us, it's actually kind of funny because in traditional cyber security in web 2, Mandant's been around for a long time, but it you have no idea how many conferences for crypto I go to and people like, Mandian, who who's that? What do you do? Right? And so we actually got acquired by by Google not too long ago. And I've got about 15 over 15 years experience in cyber. And I do threat intelligence. It's not common in crypto that you hear folks that do threat intel. And what that means is I identify and track bad guys. Not just onchain, not just tracing, but what are

they actually doing? What what does their infrastructure look like? What does their malware look like? How are they operating? what social media profiles are they using? Um what kind of fishing hooks are they using? That's threat intelligence. And so I've worked for a couple startups. Uh this is actually my my second time at Mandant. And today I'm going to tell you about a little thing called either hiding. So here's the bottom line up front. I don't want to bury the lead. Okay. Attackers are using blockchains for resilient hosting of malware and command and control operations.

This marks a big shift from what they traditionally use which is called bulletproof hosting services which I'll explain those in a moment and I want to talk about what's going on and what we as a community can actually do about it. So a lot of talks you've heard today are about the security of of what's going on on chain. I'm going to tell you how onchain activity is being used to actually infect folks offchain and it's being used to target not just the cryptocurrency industry but other industries as well and we as a community actually have an opportunity where we can do something about this.

So either hiding is a a term that was coined by Guardio in October of 2023 and they did it when talking about clear fake. If you haven't heard of Clear Fake, I actually have on the slide on the right side an image from their blog. And in in that you can see that you know these are the fake update kind of uh infections. Hey, your browser you know you need to update Chrome, you need to update Edge, you need to update Firefox. That's that's clear fake. And this clear fake campaign, what they identified is that portions of the malware were actually being stored on chain.

They were using that immutable storage, that high resilient uptime to store pieces of malware on the blockchain, which has a a whole myriad of benefits. And so since then we have actually we at Mandant have ident we've observed numerous thread actors adopt either hiding across a variety of of blockchains. So I have a QR code here on the screen. If you want to scan the QR code, you'll find out whether or not it's it's a Rick roll. Okay? And you can actually follow along and you can look at some of these transactions. If you've never looked at a North Korean smart contract today, you're about to get the opportunity to.

And so on the slide here is a it's an example transaction from a clear fake uh contract in interacting with a clear fake contract. Um but we've seen a variety of thread actors adopt either hiding. Uh there's a malware as a service thread actor uh that sells a a piece of malware called Cherry Quirk. And so we just recently identified that they were selling access uh they were selling cherry quirk which has some onchain components and that's been used by a thread actor called Fen 6 for ransomware operations. So now you have malware onchain that's enabling ransomware. Uh we've identified a North Korean threat actor, a suspected North Korean threat actor called UNK 5342.

They've been using BSC and Ethereum. Uh, and that's actually what we're going to spend most of the time this session looking at. And then on 5142, which uses clear fake, they use B&B smart chain. And that that's not exhaustive. There's other thread actors doing this. This is a popular thing. If you're curious what that uh that clear fake uh transaction on the slide actually decodes to. Here's output from a tool called Cybersh. And that decodes to offiscated JavaScript. I'm sure no one working in security in web 3 has ever seen that before, right?

So, how does it work? Either hiding implementations, they vary depending on the thread actor. Uh, a lot of thread actors, I think the the ones that are more sophisticated, they opt to use storage variables inside of smart contracts. And so then all they have to do is anytime they need an update to that malware, they just store that update inside the storage variable. they can do a query, they pull down that storage variable and that gives them the latest and greatest configuration information, actual malware components, etc. Uh sometimes though, they'll just use raw transaction input and we'll look at one of those too.

So 5342, that's a suspected North Korean threat group. They use a standard ERC20 token contract with a slight modification. they have a transaction text variable. And so whenever they call the mint function, they include the actual uh malicious code in that uh transaction text. And again, they do this not so that they can infect people on chain. They do this so that when they infect a user, they can pull down a second stage of their malware. And that second stage malware, it's reaching out to blockchains to pull down this data.

You'll also notice that we, you know, I call them UNC 5342. I don't call them Lazarus Group. One thing that the crypto security community loves to do is call everything North Korean Lazarus. And that's good and it's bad. It's good because it's a catchy name. It helps with awareness, but it's bad because it's not precise. There's not one North Korean threat group that's targeting folks. There's not two. There's not three. There's a huge number of North Korean threat groups that are targeting folks. And having precision in how we address that is important because with that precision, we can identify the different TTPs, the different tactics, techniques, and procedures used by the different groups. And through that, we

can identify are their tactics evolving, are they using different families of malware? Are they behaving differently? So 5342, that's a North Korean group, suspected North Korean group. They've used either hiding as part of a campaign called contagious interview. If you haven't heard the words contagious interview, you've definitely heard about the the attack technique. The the previous panel just referenced it, right? Contagious interview is where North Korea, they will stand up a fake recruiting firm. They'll stand up a fake company. They'll reach out over LinkedIn, over job sites, and they'll offer developers a job. and they offer a

lot of money, right? It looks very lucrative. They they're aggressive. They want to get you hooked. This campaign is part of that. This threat group is is doing that campaign and they're using smart contracts as part of it. So, there's a little little bit of irony there, right? Some bitter irony that they're actually using blockchain as part of their infection method for uh for blockchain developers. And so here is a uh an example of them using the transaction input data. Not not a smart contract, just raw transaction input data to store. Uh in this case, it's called invisible ferret.javascript.

This is a version of the invisible ferret malware. This is malware that has the ability to go steal the vaults from your your cryptocurrency wallets, from your browser extensions. It has the ability to steal that as and they'll collect it. has all kinds of capabilities and looking at the uh do I have a laser? I don't have a laser. I do have a laser. You can't see it though. Um so the the way contagious interview generally works is it begins with you know they reach out. They convince a developer to to take an interview. With that interview they offer or they they require a technical component. You have to prove that you actually know what you're doing. You have to compile some code.

you have to fix some code and when you compile and execute that code usually it's pulling something off of GitHub it's pulling down an npm package that will actually infect the victim's machine. So at that point the developer box is owned. Now if you if if you've heard folks talk throughout the week or throughout the last few days about you need endpoint detection and response on your machines, you need to have a security team. You need to monitor stuff. You need to actually have corporate machines and not just user personal machines. This is part of the reason why because developers will they will take an interview and it's a nation state targeting them. It's asymmetric, right? You cannot expect every developer to protect against every nation state

attack. It's it's not realistic. And so the uh the victim gets infected and an initial downloader is what infects them. And so with that initial downloader, it reaches out on chain to a smart contract and that's when it pulls down the Jade Snow malware. Jade Snow is the second stage. All right. Depending on what the threat actor sees, what the North Koreans see on the victim's machine, they will then decide if they want to pull down a third stage or not. depends on what organization are they working for, how much money is in their wallet, what what are they actually doing, what or you know uh who are they affiliated with and that's when they will decide whether or not to um use the third stage malware as well as what

operating system are they using and what software do they have. So let's talk about why they're using either hiding. What is the point of it? They're using either hiding because it's actually a lot more effective than traditional bulletproof hosting. If you're not familiar with bulletproof hosting, it's been around for a long time and that's where you'll get hosting providers and these are, you know, shady folks on Telegram and darknet market forums and they are offering to to host malware for you, to host malicious sites for you. They say we we're bulletproof.

It's not going to get taken down. And so usually they'll host it maybe somewhere that uh in a country where law enforcement isn't too keen on taking down any malicious content. Maybe it's uh they'll actually use victims as well. So they may have infected a whole lot of individuals with residential internet and they'll proxy well they'll use those for hosting or they might use proxies and so they'll have you know when when someone is trying to uh to log into the website or connect to the website where that where the uh malicious content is hosted it might take a while and that introduces latency issues. So bulletproof hosting, it's supposed to be

high up time, hard to take down, and that's why it's used by bad guys, but it's got a lot of drawbacks. One of them is high turnover. If you're hosting malicious content, you're not going to be around forever. Law enforcement, eventually you'll become a big enough fish that law enforcement will care, at which point, you know, your service goes down or you make enough money where you leave. Uh they also do rugps, right? So, some of these bulletproof posters, they'll take a bunch of money. They'll take a bunch of crypto. They'll get paid in crypto. And again, they're advertising on Telegram. They're advertising on social media. They're advertising on darknet markets and they they get a, you know, a lot of payments and they decide, I'm good. I've got enough money and they shut their service down. They disappear. After all, this is not a legitimate hosting provider. This

is not a cloud hosting provider. Um, they're unreliable, right? Both and the sellers. the infrastructure might be taken down even though it's supposed to be bulletproof. It's supposed to be high uptime. That's not always true. And the sellers themselves, these these are shady individuals, right? There's no honor no honor amongst thieves. The infrastructure itself is not fast. Again, this is not 99.99% uptime at a at a data center. There's latency issues and the cost varies. Now, compare that with either hiding, right?

You're utilizing services by established companies. You're using API endpoints. You're using RPC endpoints. And those are part of legitimate companies, companies that have been around for a while. They have high reliability. They're actually hosting things in data centers, right? The blockchain has high reliability. And there's also less chance of detection. So you have to consider how security heristics work. If there is a new domain that had that is using a free TLS certificate, it was recently registered, it's not well known, low traffic, it's hosted in ASN, that's in, you know, the the bad part of the internet, then security heristics are going to look at that and they're

going to say, "Okay, well, this is suspicious, they're going to flag it." Versus an RPC endpoint or an API service, as you just heard one of the previous talks, there's hundreds of those. And so those have been around much longer. They're established domains using real TLS certificates that that are actually paid for and look much more legitimate. So it bypasses a lot of those horistics. It's also cheap for UN uh 5342. We we we actually did the math to calculate what is the average transaction for them doing this activity. It's a$137 per transaction for effectively permanent uptime of malware.

they can pull down that malware as many times as they want. They're going to stay within the free usage of API services, right? Because it's not like they're doing this thousands of times, right? Maybe hundreds or dozens. So, they're staying within free usage on the API services and the the malware is staying on chain forever. That is incredibly cost effective. Incredibly cost- effective. So, let's think about what we can actually do about this. And so, I've got two slides on this. This this this is the the less controversial of the two slides. All right.

Awareness, education. People need to know that this kind of attack is happening. And when they know this kind of attack is happening, when you're aware of it, that makes you much less likely to to become infected. You know what to look for. If it seems too good to be true, then it it probably is. uh when they're doing these interviews a lot of times they'll move over to discord they'll move over to telegram but the core part of the attack that initial infection it that comes during the technical assessment phase the other thing that we should consider is taking action to actually stop the adversaries stop the threat actors from misusing from abusing these services cryptocurrency is not near as

decentralized as we all wish it was this malware it's using API I services. It's using RPC endpoints to collect data from the transactions themselves, to collect data from the storage variables, right? That's a core part of either hiding. If you shut that off, if you turn off those endpoints, they can't pull down those pieces of malware anymore. Those components become unavailable. And that does a few different things. One, that stops further infections. So even if someone is infected with that initial downloader, that initial downloader is configured to go out to the blockchain. If those RPC services, if they don't respond, if they come back with nothing, there's no second stage.

There's no third stage that prevents further infections, that saves people from becoming more substantial victims. The other thing it does is it applies pressure on the threat actors, pressure to go somewhere else. show them that there's no quarter within crypto for them to abuse services to deliver malware to folks that should not be receiving that malware, right? Stop them from creating more victims. And that is actually something that can be done, right? So if anyone is hosting or affiliated with an API service and RPC endpoint, think about if you have the technical capability to do this, if you have the legal permission to do this and

how you would actually execute it because there's a variety of different ways that you could do it, but it could provide an immense amount of value because you would actively be stopping threat actors from furthering infections. And with that, we will go over to some questions if folks have questions. And thank you. [applause] [music] >> Any questions? No. >> Thank you for the lecture. H my question is in web 2 CNC we also have an upstream from the malware back to the attacker.

Have you seen such thing in web 3 where the malware generates like right stuff to the blockchain to communicate back to the attacker? Could you say it again where um where >> like licking back data from the computer to the to the CNC server through the blockchain. >> So we we've seen blockchain SC2 where they're actually like posting up what domains to use on chain. um we haven't seen them initiate transactions to to my knowledge we haven't seen them initiate transactions from the victims right because when they're doing you know these uh calls to the RPC services and the RPC endpoints and the API services

it's not actually creating a transaction right it's just reading what's already statically on chain I don't think we've seen them create new transactions for victims >> I don't think >> yes thank here to showcase >> you Mike's coming. >> So I get I think three three of those kind of uh >> contact I get three of those kind of contacts over LinkedIn uh sharing some technical assessment a week uh and I realized that they they they are getting more and more uh sophisticated. So you don't find anymore the encoded JavaScript uh they they load it. Uh so I tried to

stop sometimes I track down uh where the payload is served. Uh nothing happens. Three three weeks after it was still active. So LinkedIn doesn't do anything. So who do you contact to to stop quickly this kind of threats? >> So so the question was and correct me if I'm wrong. The question is when you see these who do you contact to actually do something about it? the like the coding challenges, the technical assessments that lead to the infections because sometimes they you know the they don't get taken down quickly. Um, it's it's a great question and I I wish I had a simple answer, but you can reach out to folks like uh Seal, you can reach out to the crypto Isac, you can let them know.

Um, you can actually, you know, if I don't encourage you to go and download any of the payloads or anything, but if you had a safe environment to do that, you could then upload it to Virus Togal and other places where it would actually be flagged because a lot of vendors will pull it from there. Um, I don't think there's a simple solution to some of that being uh blocked. Know we're short on time. If we have time for one more, so thank you for your presentation. Um, I was actually thinking so regarding one of your last slides where you were suggesting that centralized RPC providers should do something about this. Aren't you worried that if they start doing something about this, it

ends up becoming a mouse and cut game where they create absurd cover channels like I don't know encrypting the payload into ERC20 tokens balances and that kind of stuff and then they could also even poison other ERC20 token balances to prevent dosing and stuff. And yeah, I'm just worried that like this doesn't work because there will always be a way to get around it on the blockchain. Basically, there will always be an arms race between defenders and attackers. That doesn't mean we shouldn't try, right? If we can add as much friction as possible and make it as hard as possible for them, that might discourage even some thread actors from doing it by making it harder for them to implement these these kinds of attacks. That's that's how I feel about it.