North Korea put its malware somewhere nobody can take down, and reaches it through a handful of companies that can
2026-10-05Security
Google Threat Intelligence has documented the first nation-state use of EtherHiding: a DPRK group storing its downloader in smart contracts on two blockchains, updated for about a dollar a time. The coverage calls it takedown-proof. GTIG's own report points at the part that is not — the attackers do not run nodes, they call three API companies.