UNC5342Threat actor
UNC5342 is a North Korea-linked APT that employs the EtherHiding technique to deliver malware and facilitate cryptocurrency theft. The actor has been observed deploying EtherRAT and JADESNOW malware, utilizing transaction history as a Dead Drop Resolver to embed payloads directly into the calldata of blockchain transactions.From MISP Galaxy
Last reported 1 month ago, by GuidePoint Security4 reports
ATT&CK techniques
6 of 52 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
- T1055Process Injection
“This post analyzes the final stage: PHANTOMPULSE, an implant that ships three process-injection techniques, resolves its C2 through Ethereum/Base/Optimism transaction inputs, and bypasses UAC via the public schuac technique.”
- T1056Input Capture
“Input Capture: Keylogging”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight“By October 2025, North Korea’s UNC5342 adopted the approach.”
-
Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet“Google's October 2025 research confirmed that North Korean state-sponsored actors (UNC5342) have since adopted the same technique, indicating that blockchain C&C has now been adopted by nation-state capability.”
-
PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT“…targeting, and infrastructure choices align with the DPRK-aligned crypto-targeting intrusion clusters that include Lazarus, BlueNoroff, UNC5342 (Contagious Interview), and APT38.”
-
DeadLock Ransomware: Smart Contracts for Malicious Purposes“For example, Google recently reported that the North Korean (DPRK) threat actor UNC5342 used a technique dubbed “EtherHiding,” which consists of leveraging transactions on public blockchains to store and retrieve malicious payloads.”
Indicators in its reports
named in the reports above- 1rpc[.]ioin 1 report
Copy this indicator · defanged
Thanks — we review every report.