Notifications
Clear all
Topic starter
02/08/2026 12:16 pm
TL;DR: EtherHiding uses smart contracts and blockchain retrieval to store malicious payloads in a tamper-resistant location, allowing attackers to persist malware and evade takedown while bypassing traditional network and AV controls, according to Cymulate research. The pattern turns decentralised infrastructure into a durable delivery and C2 layer, which makes Web3 visibility a practical control issue rather than an edge case.
NHIMG editorial — based on content published by Cymulate: Simulating EtherHiding: Blockchain as a Malware
Questions worth separating out
A: Teams should detect the retrieval path, not just the payload.
Q: Why is blockchain-based payload storage harder to remove than conventional malware hosting?
A: Because the payload lives on a distributed ledger rather than on a single compromised server.
Q: What breaks when defenders do not monitor blockchain activity as part of threat detection?
A: The kill chain becomes invisible between staging and execution.
Practitioner guidance
- Monitor RPC and blockchain retrieval paths Add detection for eth_call-style retrievals, contract reads, and unusual blockchain queries that precede endpoint execution.
- Whitelisted approved RPC endpoints Restrict which applications and hosts can reach blockchain RPC infrastructure, and review whether access is justified by business need.
- Correlate retrieval with execution Link network telemetry to endpoint telemetry so a blockchain read followed by script, shell, or loader execution becomes a single alert path.
What's in the full article
Cymulate's full article covers the operational detail this post intentionally leaves for the source:
- The step-by-step EtherHiding simulation flow, including how the concealed payload is retrieved from a smart contract.
- The example scripts and RPC mechanics used to fetch payload bytes from the blockchain.
- The specific attack scenarios Cymulate added for live testing of blockchain-delivered malware.
- The platform-level testing context for validating EDR and SIEM detection against Web3 retrieval patterns.
👉 Read Cymulate's analysis of EtherHiding and blockchain-delivered malware →
Blockchain malware delivery: what EtherHiding means for defenders?
Explore further
02/08/2026 1:18 pm
Blockchain persistence creates a new kind of delivery resilience: the payload is no longer anchored to a host that defenders can simply quarantine. That changes the defender model from removal to detection of retrieval behaviour, especially when blockchain or RPC requests precede execution. For teams responsible for security architecture, the practical question is whether the control stack can distinguish legitimate Web3 interaction from payload retrieval.
A question worth separating out:
Q: What should teams do when blockchain traffic appears in an environment that does not use Web3?
A: Treat it as a high-priority anomaly and investigate the host, process, and identity path that initiated it. In environments with no legitimate blockchain use, any RPC contact deserves review for loader activity, persistence attempts, or covert C2. If the traffic is not expected, isolate the source and validate nearby accounts and automation.
👉 Read our full editorial: EtherHiding shows how blockchain can support persistent malware
