Hackers Turned Ethereum Into a Secret Messaging System for Malware
North Korea-linked XCTDH malware encodes C2 server addresses into Ethereum recipient addresses, giving its RAT and credential stealer resilient command channels.
68
Organization
Ransom-ISAC
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 19, 2026
- Last mentionedSep 29, 2026
Timeline
5 articles · newest firstDPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware
DPRK-linked hackers added Ethereum HashHiding so malware can recover C2 addresses from ordinary transfers.
76
Macfinger ClickFix campaign, (Tue, Sep 22nd)
SANS documents 'Macfinger ClickFix' campaign injecting scripts into legitimate sites to deliver macOS credential-stealing malware with C2 at 95.163.153.80:8133.
55
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.
76
The long tail of Clop’s PTC hack is just beginning to emerge
Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.
85
Related CVEs
by mentions- CVE-2026-1256946%9.3Unauthenticated RCE in PTC Windchill and FlexPLM
Appears with
- ReliaQuestorganization · 2
- PTCvendor · 2
- Clopthreat actor · 2
- FlexPLMproduct · 2
- The Hacker Newsorganization · 1
- Oracle E-Business Suiteproduct · 1
- eCrime.chorganization · 1
- Ethereumproduct · 1
- XCTDHorganization · 1
- BNB Smart Chainorganization · 1
- DPRK-linked XCTDH operatorsthreat actor · 1
- BNB Smart Chainproduct · 1
- Clop Windchill web shellmalware · 1
- TRONproduct · 1
- GEvictim · 1
- Philipsvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.