Threat Intelligence Analyst: 2026-09-28

1. XCTDH Adopts Hash Hiding

   Ransom-ISAC, 2026-09-25. Read, 19 min.

   Ransom-ISAC reports that September 2026 samples from the DPRK-attributed XCTDH campaign carry a new module that distributes command-and-control addresses through Ethereum mainnet transactions, a method OpenSourceMalware documented publicly as NullReceiver in August 2026. The campaign delivered the DEV#POPPER.js remote-access Trojan and the OmniStealer credential harvester, and Ransom-ISAC says the on-chain record shows a first beacon on June 23, 2026.

   Why it matters for this role: Watch the XCTDH signaling wallet on Ethereum to follow the campaign's C2 rotations, which Ransom-ISAC says happen with no change to the malware code.

Threat Intelligence Analyst