🕵️ RESEARCH & DEEP DIVES
- North Korean Hackers Hide Malware Servers in Empty Ethereum Transactions
North Korean hackers use empty Ethereum transactions to conceal malware command servers.
- Targets developers via malicious npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8
- Malware hides command-and-control server IP in recipient address of empty Ethereum transfers
- Uses public Ethereum RPC services https://1rpc.io/eth and https://eth.drpc.org to retrieve commands
- Technique named NullReceiver linked to DPRK Contagious Interview operation supply-chain attacks
- Command server IP decoded as 166.88.134.62 with HTTP/HTTPS endpoints on ports 80 and 443 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
🔓 CVEs & KEV
- CVE-2026-18569 — CVSS 3.7 — Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned requests
- CVE-2026-68744 — CVSS 3.3 — Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
- CVE-2026-18739 — CVSS 2.5 — Popt-devel: popt-static: off-by-one in poptstuffargs
- CVE-2026-16881 — CVSS unknown — A code injection vulnerability exists in the LINE Android app prior to version X