NullReceiver

Reported Context (4)

membership is this report's own finding, established from the sample. The researchers who documented NullReceiver further attribute it to North Korea; that step is theirs rather than ours, it is cited here rather GHAPPIER npm Loader Compromised a Package Release; Researchers Link a Second Payload to PolinRider
Paul and Jenn cover what’s changed in the kill chain: a new NullReceiver-branded payload, a persistence technique that overwrites the npm CLI binary itself so simply removing payloads from repos isn’t sufficient, and an TeamPCP Arrests and PolinRider’s Persistent Reinfections Lead OpenSourceMalware Show #19
This is the NullReceiver loader. PolinRider Campaign Keeps DPRK Malware in Compromised Developer’s npm Releases
We’re calling it NullReceiver, and we think it’s a deliberate improvement on EtherHiding. DPRK-Linked npm Malware Hides C2 IP in Blank Ethereum Transfer Addresses

Malware (2)

People (7)

Threat Actors (2)

MITRE ATT&CK (5)

Vendors (2)

Products (8)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.