Story perspectives

North Korean Hackers Innovate with EtherHiding Technique

10/17/2025

41 7

Summary

Story summary

The North Korean hacking group UNC5342 has adopted EtherHiding, the first use of this method by a state-sponsored actor previously linked to financially motivated groups.
The campaign, Contagious Interview, uses social engineering to prompt victims to run malicious code framed as job assessments.
EtherHiding exploits public blockchains such as Ethereum and BNB Smart Chain, hindering takedown efforts.
The technique enables rapid payload updates, complicating detection and mitigation.

1 of 1

Story summary

The North Korean hacking group UNC5342 has adopted EtherHiding, the first use of this method by a state-sponsored actor previously linked to financially motivated groups.
The campaign, Contagious Interview, uses social engineering to prompt victims to run malicious code framed as job assessments.
EtherHiding exploits public blockchains such as Ethereum and BNB Smart Chain, hindering takedown efforts.
The technique enables rapid payload updates, complicating detection and mitigation.