Palo Alto Networks Unit 42 documented the delivery chain on May 22. A search for open-source C++ IDE software led users to a legitimate site before interaction-gated JavaScript on an attacker-controlled CloudFront distribution redirected them to a fake MEGA Transfer page. Gurucul summarized that record on May 28 and published detection queries. Separately, ANY.RUN’s rolling family tracker listed Remus-tagged sandbox submissions through August 11, including a submission tagged etherhiding. That is evidence of recent sandbox observation, not proof of a newly compromised victim or a distinct active campaign. ANY.RUN says Remus “utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns.” Windows users who execute the delivered loader are directly exposed; organizations are affected when the compromised browser holds corporate sessions, credentials, developer tokens, or access to cloud services.
The blockchain is not carrying the stolen data in the cited analysis. It acts as a resilient directory. Remus uses an Ethereum smart-contract dead drop to retrieve its current command infrastructure. That separates the stable lookup path from downstream infrastructure that defenders may block or operators may replace.
A poisoned download starts the resolver chain
Unit 42 traced the exact chain. The legitimate site loaded JavaScript from the attacker-controlled CloudFront distribution d33f51dyacx7bd[.]cloudfront[.]net. The script used browser fingerprinting, interaction telemetry, hidden iframes, and click interception before routing a user through an intermediary to the fake transfer page. The campaign parameters subid, tid, and session_id persisted across stages. The script also contained the product markers IS_POP_PRODUCT and IS_FAKE_PLAYER_PRODUCT.
The fake page generated a password-protected archive containing a Garble-obfuscated Go loader. Finding the archive or loader proves delivery or staging. It does not prove execution. Unit 42 separately reports that an executed loader uses a five-stage decryption routine to load Remus reflectively in memory. After Remus executes, it contacts shivlpf[.]shop and queries the legitimate eth.llamarpc.com service for Ethereum contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF, which returns the current command-server URL.
Remus uses EtherHiding as a dead-drop resolver. The contract lookup supplies the next network destination. LlamaRPC and Ethereum are legitimate shared services used by unrelated applications, so traffic to either is insufficient evidence on its own and blocking every connection would disrupt benign workloads.
Figure details
A fake software page provides an archive containing an obfuscated loader. The archive and loader are staged until a user runs the loader. After execution, the loader reflectively loads Remus in memory. Remus queries a legitimate Ethereum RPC service for a smart contract that points it to changeable downstream infrastructure, then accesses browser credentials, cookies, authentication tokens, password-manager data, and cryptocurrency wallets. Defenders can correlate execution, the exact contract lookup, the newly resolved destination, browser access, and subsequent outbound traffic.
Correlate resolver and browser access
ANY.RUN reports that Remus targets Chromium-based browser data, including saved credentials, cookies, and authentication tokens. It also describes collection from password managers and cryptocurrency wallets. Some observed behavior uses browser-process injection or a hidden browser context to reach protected data. Stolen live cookies and tokens matter because an attacker may be able to reuse an authenticated session without replaying the password or satisfying the original MFA challenge.
No single artifact is enough to clear or convict an endpoint. Ethereum infrastructure has legitimate uses, and the published C2 domains and IP addresses can rotate. The stronger detection is a time-bounded chain: an unexpected installer or Go executable runs from a download or temporary location; that process or a child contacts the published Ethereum endpoint; it connects to a new destination soon afterward; and the same process tree accesses browser stores, injects into a browser, or produces unusual outbound traffic.
Preserve the original file and its hash, download URL, browser history, process tree, command line, loaded modules, DNS and proxy records, and endpoint telemetry. Review for access to contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF through eth.llamarpc.com, while treating the service itself as legitimate. ANY.RUN’s evidence cache, fetched August 9, lists the IP addresses 160.119.69[.]4, 72.60.121[.]225, 45.141.27[.]68, 185.53.179[.]128, 196.251.107[.]104, 165.227.199[.]109, 94.231.205[.]229, 196.251.107[.]130, 217.156.122[.]75, 188.40.60[.]27, 65.21.104[.]235, 62.72.32[.]156, 168.231.114[.]49, 103.211.219[.]238, 76.13.17[.]11, 31.97.61[.]212, 45.85.147[.]53, 137.184.153[.]47, 89.58.10[.]69, 147.135.84[.]14, and 178.104.90[.]74. Its listed domains are miedorama[.]com, axoshealthcare[.]com, midpfv[.]xyz, 1printers[.]com, angect[.]xyz, lawofi[.]xyz, bluyterm[.]com, driven-wild[.]com, millersteelusa[.]com, hatcae[.]xyz, xstrapper[.]com, kereta-tinted[.]com, forestoaker[.]com, iuta[.]today, oundhertobeconsist[.]org, firewai[.]biz, chalx[.]live, hotstz[.]xyz, and strgsd[.]xyz. Unit 42’s record, later summarized by Gurucul, additionally identifies pulse.cryptowavematrix6[.]cyou, scroogeearthbornwyson[.]com, dwn.nexusriftcore9[.]cfd, mascard[.]biz, shivlpf[.]shop, IP address 104.21.72[.]4, and SHA-256 0a6a792109809ef8. Keep those lookups scoped to the relevant execution window. A hit is a lead. An absent hit leaves earlier exposure unresolved because the contract value and downstream infrastructure can change.
Browser compromise becomes identity response
The contract defines one directory in the chain. The useful damage remains on the endpoint and in accounts reachable from that browser profile. Blocking one resolved host interrupts only one path and leaves earlier exposure unanswered.
The cited research does not provide a complete victim count or prove that every Remus build behaves identically. It also does not report a vendor response, takedown, or remediation advisory from a named software vendor. Traffic to Ethereum infrastructure is not itself suspicious. Scope those claims carefully. Keep the boundaries explicit in alert logic and case notes.
Anchor the case in identity use
Identity use determines the scope.
Hunt the sequence rather than the blockchain domain alone: an unexpected installer or Go loader, traffic to the published Ethereum endpoint, a newly resolved destination, and browser access or injection followed by outbound traffic. Preserve the initiating file, process tree, DNS, proxy, endpoint, browser, and identity logs.
Isolate confirmed hosts, revoke browser sessions, rotate readable credentials, tokens, and wallet secrets from a clean device, and review cloud, email, VPN, developer, and financial account activity during and after the exposure window.
The expected endpoint result is no unapproved process tree combining the exact contract lookup, browser-store access, and a listed Remus destination. The expected identity result is that revoked sessions do not reappear and no unexplained sign-in, token use, account change, or new session follows the exposure window after clean-device rotation.
EtherHiding makes a domain block feel more decisive than it is. The contract is a directory, not the crime scene; Remus matters because a host can ask a legitimate RPC service where to send stolen sessions next. Confidence comes from an identity timeline that explains every account change and session after the host was exposed.