T1102.001 Dead Drop Resolver: EtherHiding Payload Retrieval from BNB Smart Chain Testnet

Browser retrieving second-stage JavaScript from smart contracts on BNB Smart Chain testnet (chainId 97). Observed 2026-08-11 in a live compromise of a high-traffic US consumer site, where a rogue Google Tag Manager container injected an obfuscated loader that issued eth_call with selector 0x6d4ce63c (get()) against attacker-owned contracts and passed the ABI-decoded string to eval(atob(...)). Payload storage on-chain means there is no seizable C2 host and no DNS to sinkhole; the operator swaps the payload by calling the owner-gated set(string) selector 0x4ed3885e. Testnet rather than mainnet is the notable deviation from previously reported EtherHiding tradecraft, faucet-funded gas makes payload hosting and high-frequency updates free. Fires on either the RPC endpoint hostnames or the known contract addresses appearing in request URIs. The higher-fidelity variant matches JSON-RPC method eth_call plus selector 0x6d4ce63c in the POST body, which requires body-logging most proxies do not perform by default; hostname coverage is the portable fallback and is used here. Contract addresses are campaign-scoped and will rotate, the RPC hostname selection is the durable half of this rule.

Intel context

The technique this rule covers is in use. This is the evidence for it as of November 7, 2026.

Technique	KEV CVEs	Research, 90d	Active families
T1102.001 Dead Drop Resolver	0	2	—

Research citing this technique

2026-10-08 · Zscaler ThreatLabz Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
2026-10-07 · Cofense From Guest Complaints to Malware: Blockchain Abuse Targets Hotels

Rule ID: 401dfb2d-8dab-59bf-984e-7b9344d725a6
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-08-11
Modified: 2026-08-11
ATT&CK: T1102.001 (signal rollup)
Canonical YAML: t1102-001-etherhiding-bsc-testnet-dead-drop.yml

References

False positives

Developer or QA workstations doing legitimate BSC testnet work: smart contract development, CI deployment pipelines, or wallet integration testing. Scope this rule to non-engineering user segments, or allowlist known dev hosts, before promoting past experimental.
Browser wallet extensions (MetaMask, Trust Wallet) with BSC testnet configured as an active network will poll these endpoints on their own.
Security research and sandbox detonation infrastructure replaying this or similar campaigns.

Rule YAML

title: 'T1102.001 Dead Drop Resolver: EtherHiding Payload Retrieval from BNB Smart Chain Testnet'
id: '401dfb2d-8dab-59bf-984e-7b9344d725a6'
status: 'experimental'
description: 'Browser retrieving second-stage JavaScript from smart contracts on BNB Smart Chain testnet (chainId 97). Observed 2026-08-11 in a live compromise of a high-traffic US consumer site, where a rogue Google Tag Manager container injected an obfuscated loader that issued eth_call with selector 0x6d4ce63c (get()) against attacker-owned contracts and passed the ABI-decoded string to eval(atob(...)). Payload storage on-chain means there is no seizable C2 host and no DNS to sinkhole; the operator swaps the payload by calling the owner-gated set(string) selector 0x4ed3885e. Testnet rather than mainnet is the notable deviation from previously reported EtherHiding tradecraft, faucet-funded gas makes payload hosting and high-frequency updates free. Fires on either the RPC endpoint hostnames or the known contract addresses appearing in request URIs. The higher-fidelity variant matches JSON-RPC method eth_call plus selector 0x6d4ce63c in the POST body, which requires body-logging most proxies do not perform by default; hostname coverage is the portable fallback and is used here. Contract addresses are campaign-scoped and will rotate, the RPC hostname selection is the durable half of this rule.'
references:
    - 'https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml'
    - 'https://attack.mitre.org/techniques/T1102/001/'
    - 'https://cloud.google.com/blog/topics/threat-intelligence/etherhiding-financially-motivated-blockchain-malware'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.command_and_control'
    - 'attack.t1102.001'
    - 'attack.defense_evasion'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_rpc_endpoint:
        cs-host|contains:
            - 'bsc-testnet-rpc.publicnode.com'
            - 'bsc-testnet.drpc.org'
            - 'bsc-testnet-dataseed.bnbchain.org'
            - 'data-seed-prebsc-1-s1.binance.org'
            - 'data-seed-prebsc-1-s1.bnbchain.org'
            - 'data-seed-prebsc-2-s1.binance.org'
            - 'data-seed-prebsc-2-s2.binance.org'
            - 'bnb-testnet.api.onfinality.io'
    selection_contract:
        c-uri|contains:
            - '0xda4e1d62c974d20c870343f540bebfaac779ed66'
            - '0x1ca902fdf2f2a26dd2a160662143029cd7d5813f'
            - '0xe447dadb4bfb4610882c8d6228a20f101f8933d6'
            - '0xf4a32588b50a59a82fba148d436081a48d80832a'
    condition: '1 of selection_*'
falsepositives:
    - 'Developer or QA workstations doing legitimate BSC testnet work: smart contract development, CI deployment pipelines, or wallet integration testing. Scope this rule to non-engineering user segments, or allowlist known dev hosts, before promoting past experimental.'
    - 'Browser wallet extensions (MetaMask, Trust Wallet) with BSC testnet configured as an active network will poll these endpoints on their own.'
    - 'Security research and sandbox detonation infrastructure replaying this or similar campaigns.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1102-001-etherhiding-bsc-testnet-dead-drop.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.