Ethereum's transaction structure enables increasingly sophisticated evasion techniques that are difficult for defenders to detect and attribute

"NullReceiver, in contrast, provides a non-existent destination address. The address 'exists' only to provide a way to encode the C2 IP address within itself. This, in turn, makes attribution difficult, as it eliminates the 'fixed, watchable destination.'"