XCTDH Campaign Hides C2 Addresses in Ethereum Using HashHiding

At the end of September 2026, the ransomware‑focused intelligence group Ransom‑ISAC published a detailed report describing a new method, dubbed “HashHiding”, that is employed by the XCTDH ransomware campaign, which is widely attributed to North Korea. According to the report, XCTDH operators began encoding the address of their command‑and‑control (C2) server in the recipient fields of Ethereum transactions that either do not correspond to any real address or carry only a negligible amount of crypto‑assets. This technique is intended to make discovery of the C2 server more difficult for security analysts, while preserving the malware’s ability to retrieve the information dynamically from the blockchain. The report was released publicly and included technical indicators to aid defenders.

How the HashHiding technique works

In a standard Ethereum transaction, the “to” field indicates the recipient’s address. Ransom‑ISAC researchers observed that XCTDH operators replace this address with a hexadecimal string that, when decoded, reveals the identifier of the C2 server. The hexadecimal string is deliberately crafted to avoid collision with legitimate addresses and the decoding typically relies on a reverse‑hash function or on a lookup table pre‑established by the malware. The transaction itself may contain zero ether or an amount lower than 0.0001 ETH, making it unattractive to miners and block explorers, yet sufficient to be permanently recorded on the chain.

The malware’s retrieval component queries a public Ethereum node or an RPC endpoint to extract the latest transactions containing the suspicious pattern. Once the transaction is identified, the malware code applies the same decoding logic used by the operators, reconstructs the IP address or domain name of the C2 server, and then establishes an encrypted connection to download payloads or decryption keys. The malware also caches the decoded address for future use, reducing the number of blockchain queries required. This approach eliminates the need for a dynamic DNS server or a hard‑coded list, rendering server rotation almost invisible to traditional detection systems.

Evidence and scope of the XCTDH campaign

The investigation by Ransom‑ISAC identified more than 2,600 transactions matching the HashHiding pattern over a three‑month period, from late July to late October 2026. During this window, the operators changed the encoded address four times, leading to the use of three distinct C2 servers. Each address change was accompanied by a short testing phase during which several dozen victims received the new loader, before the new configuration was widely deployed. The analysis also showed a correlation between the address changes and spikes in ransomware activity, confirming that the technique is not an isolated test but an integrated component of the XCTDH infrastructure chain.

Beyond Ethereum, researchers found that the same operators replicate the HashHiding scheme on other smart‑contract networks, including BNB Smart Chain, TRON and Aptos. This diversification forces defensive teams to monitor multiple block explorers simultaneously and to implement correlation rules across the different ledgers. Because each chain has its own fee and confirmation parameters, automated blocking becomes more complex, as a masked address on Ethereum can be quickly reproduced on BNB Smart Chain at marginal cost. The researchers noted that the cost of posting a zero‑value transaction on these alternative chains is comparable to Ethereum, making the approach economically viable.

Limitations of the concealment

While the HashHiding technique makes C2 rotation more resistant to manual blocking, it does not render the malware undetectable. Analysts can still identify suspicious transactions using filters based on transaction size, the absence of transferred value, and the presence of recurring hexadecimal motifs. Moreover, the decoding code must be present in the binary or downloaded during the initial infection, providing an anchor point for static or dynamic analysis‑based detection solutions. Furthermore, the presence of the decoding routine in memory can be detected by behavioral monitoring tools.

Incident response teams have begun integrating HashHiding transaction signatures into their blockchain monitoring systems. These signatures look for destination addresses that do not match any known wallet and that are associated with amounts below a predefined threshold, typically 0.001 ETH. In parallel, sandboxing solutions can instrument malware behavior to spot calls to Ethereum RPC APIs and hexadecimal data decoding, triggering early alerts before the loader contacts the C2 server. These signatures can be updated automatically as new patterns emerge, ensuring continued coverage.

• Monitor Ethereum, BNB Smart Chain, TRON and Aptos transactions for HashHiding patterns
• Deploy minimum‑value filters to ignore suspicious micro‑transactions
• Integrate decoding signatures into EDR and sandbox solutions
• Block or redirect RPC requests to trusted, enterprise‑controlled nodes
• Share indicators of compromise (IOCs) with ISAC communities for coordinated response

For enterprises, the presence of HashHiding means that simply blacklisting IP addresses or domains is no longer sufficient to disrupt the infection chain. Threat actors can change the C2 address within hours without alerting network filtering systems, while leaving a permanent trace on the blockchain. Organizations therefore need to broaden their detection perimeter to include public blockchain activity, combining network traffic analysis, RPC call logs and intelligence on suspicious transactions. Enterprises should also consider integrating blockchain analytics APIs into their security information and event management (SIEM) platforms.

In light of these findings, cybersecurity teams are urged to update their ransomware response playbooks to include blockchain monitoring procedures and specific alert rules for the HashHiding technique. Ransom‑ISAC also recommends strengthening cooperation among cloud service providers, block explorers and exchange platforms to facilitate rapid reporting and neutralization of masked addresses. Such collaborative frameworks have already proven effective in earlier ransomware disruptions, and extending them to blockchain contexts is a logical next step. By adopting these measures, defenders can reduce the advantage that Ethereum‑based concealment gives XCTDH operators and limit the reach of their future campaigns.