[null-receiver]

August 14, 2026

• DPRK-linked NullReceiver loaders found in infected GitHub repositories. The loaders decode Ethereum wallet recipient addresses as embedded IPv4 stages — reusing the C2 technique documented by OpenSourceMalware. (OpenSourceMalware) · Threat Activity

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries

August 4, 2026

• DPRK's Contagious Interview operation adopts "NullReceiver," a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com). · Threat Activity

in Attackers Seize N-central RMM Servers After N-able's Second Fix Falls Short