Skip to content

NullReceiver

Named by 5 kept items in this workspace.

Search every workspace for NullReceiver. It matches the name as written, so it can find other things that share it.

The items that name it 5

  • Evolution of Web3 in Cloud Supply Chain Attacks
    article2026-10-07It is written here as NullReceiver (zero-data address resolution C2 technique/malware seen in bianira-ui and fluid-type-ui).

    zero-data address resolution C2 technique/malware seen in bianira-ui and fluid-type-ui

  • PolinRider is A/B Testing its Way Past Your Detections
    writeup2026-09-26

    Technique (documented by the author in August) where a loader reads the most recent transaction from a fixed Ethereum wallet, decodes a C2 IP address from the recipient address, and fetches the next stage; used by the 500 variant payload.

  • NPM Isn't Prepared For North Korean PolinRider Attack
    writeup2026-08-25

    DPRK C2 loader used by PolinRider, employing blockchain-based (Ethereum RPC) C2 communication; found disguised as a fake .woff2 font file and appended to legitimate config files like babel.config.cjs.

  • The OpenSourceMalware Show #17
    talk2026-08-14
  • The OpenSourceMalware Show #16
    talk2026-08-08

    New DPRK-linked (Lazarus Group) C2 technique that hides a C2 IP address, short URL, or short redirect string inside the recipient address of a zero-value Ethereum transaction; evolves EtherHiding by avoiding a fixed, publicly known destination address; confirmed on at least 10 npm packages so far; l

All threat actors in this workspace.