Aeternum Botnet Uses Polygon Smart Contracts for Resilient C2
Key Takeaways A new botnet loader, Aeternum, leverages Polygon smart contracts for resilient command and control (C2) infrastructure. This blockchain-based approach makes takedown operations...
Key Takeaways
- A new botnet loader, Aeternum, leverages Polygon smart contracts for resilient command and control (C2) infrastructure.
- This blockchain-based approach makes takedown operations significantly more challenging compared to traditional C2 servers.
- Aeternum delivers various payloads, including XWorm, XMRig cryptocurrency miners, and information stealers targeting crypto wallets.
- The malware employs anti-analysis techniques and establishes persistence on compromised Windows systems.
- Defenders should monitor for unusual Polygon JSON-RPC traffic and correlate it with other suspicious activities.
A new botnet loader, dubbed Aeternum, has emerged, utilizing an innovative method for command and control (C2) that significantly enhances its resilience against takedown efforts. Instead of relying on conventional servers, Aeternum stores its instructions on Polygon, a public blockchain, creating a distributed and highly redundant control channel that is exceptionally difficult to dismantle.
Table Of Content
Investigators have traced the malware’s infection vectors to Windows systems through various means, including a packed loader, a bundle containing XWorm and XMRig, and Python code disguised within a fake DBeaver installer.
Upon execution, the Aeternum samples perform checks for virtual machine environments and security tools, establish persistence to ensure continued operation after reboot, and then proceed to retrieve further commands from the blockchain-based C2 infrastructure.
Researchers from Unit42 have identified this campaign as an evolving threat, noting its sophisticated use of Polygon smart contracts for C2. Their analysis revealed shared code patterns and contract functions across three distinct malware samples, demonstrating how a single blockchain service can orchestrate various malicious activities—from deploying loaders and spyware to facilitating data theft and cryptocurrency mining—without depending on a centralized, easily-identifiable server.
Unit42 researchers said in a report shared with Cyber Security News (CSN) that the scope of Aeternum extends beyond a single malicious file. The botnet is capable of deploying additional malware, gathering sensitive host and cryptocurrency wallet information, and exfiltrating this data via platforms like Telegram or other C2 servers.
The research, which recorded over 29,000 detection events by June 4, 2026, underscores the growing practicality and adoption of blockchain-backed C2 mechanisms by cybercriminals.
Aeternum Botnet Uses Polygon Smart Contracts
Aeternum’s innovative use of a smart contract on the Polygon blockchain functions as a public bulletin board for infected devices. This design fundamentally alters the landscape for incident responders, who can no longer simply target a single hosting provider or domain registrar to neutralize the botnet. Instead, the challenge shifts to identifying and mitigating the malware’s activity on each compromised endpoint, even as the C2 instructions remain universally accessible and pose a continuous threat of reinfection or expansion to other systems.
Each infected bot queries Polygon’s remote procedure call (RPC) services to read a specific contract value. This value either contains a direct command or provides the address for the next stage of the malware operation. The inherent distributed nature of blockchain technology means that blocking a particular web host or domain will not remove these persistent on-chain instructions.
The loader component of Aeternum uses a domain-retrieval function to obtain an XOR key, which then decrypts the actual command-and-control domain. Furthermore, the botnet operators possess an administrative function within the smart contract that allows them to update the stored destination, effectively redirecting existing infections to new C2 infrastructure. This architectural design bears a resemblance to the blockchain resolver technique previously observed in SharkStealer command infrastructure analysis, but Aeternum extends its application across multiple malware components.
One analyzed loader sample demonstrated a multi-stage infection process: it unpacked itself, copied malicious files to the AppData directory, and created a Windows Startup shortcut for persistence before initiating contact with Polygon. It then proceeded to download both seemingly benign and overtly malicious files from various code repositories. A dynamically linked library (DLL) within this sample gathered system information and prepared it for exfiltration via Telegram, illustrating how a public blockchain lookup can seamlessly integrate with common web services for delivery and data transfer.
A notable weakness in Aeternum’s implementation of encryption has provided a potential avenue for defenders. Researchers successfully recovered encrypted instructions, including download commands, by leveraging the smart contract address and the returned payload. This suggests that while the C2 mechanism is resilient, the communication itself may not be entirely impenetrable.
Payloads Turn Access Into Theft
A second sample analyzed by researchers utilized the same on-chain lookup method to retrieve a Pastebin URL containing the configuration for an XMRig cryptocurrency miner. This particular variant deployed an XWorm remote-access tool and the miner, subsequently sending encrypted victim data to an external address. This follow-on capability aligns with recent XWorm malware activity, which frequently involves credential theft and session hijacking.
The Python source code associated with Aeternum suggests a highly targeted operation. It masquerades as a DBeaver installer, incorporates mechanisms to evade detection by lightweight analysis environments, establishes persistence, and injects malicious code into a signed Windows binary before security monitoring tools can fully initialize. Critically, this variant also includes routines designed to steal credentials from over 55 cryptocurrency browser extensions and 10 desktop wallets.
Telegram plays a dual role in this branch of Aeternum, facilitating both reconnaissance and data exfiltration. The inclusion of “junk-filled JSON” in communications further indicates an attempt to obscure traffic patterns and make detection more challenging. This strategy highlights how attackers are increasingly leveraging widely available public services, rather than maintaining all infrastructure themselves. Similar abuse of public platforms has been observed in Paste platform XWorm campaigns, emphasizing the critical need for defenders to focus on behavioral monitoring rather than trusting services solely based on their name.
The trend of blockchain-based botnets is expected to continue, making proactive defense essential. Defenders must actively investigate the provided indicators of compromise, rigorously restrict unapproved executable files, and analyze telemetry for Polygon smart contract queries that precede suspicious downloads, code injection, or data transfers. Furthermore, security teams should implement alerts for process launches from user-writable folders and scrutinize outbound network connections immediately following any blockchain lookup activity. The ability of operators to rotate C2 destinations without rebuilding the entire botnet underscores the need for continuous vigilance.
What You Should Do
- Monitor Network Traffic: Actively hunt for unusual Polygon JSON-RPC traffic within your network. Correlate this activity with other suspicious events like new Startup shortcuts, unauthorized file downloads, or Telegram API communications.
- Restrict Executable Execution: Implement strict application whitelisting policies to prevent unapproved executables from running on endpoints.
- Review Telemetry: Analyze endpoint detection and response (EDR) and security information and event management (SIEM) telemetry for any Polygon smart contract queries that precede unexpected file downloads, process injection attempts, or data exfiltration.
- Alert on Suspicious Process Launches: Configure alerts for any process launches originating from user-writable folders (e.g., AppData, Temp directories), as these are common locations for malware persistence.
- Verify Outbound Connections: Scrutinize all outbound network connections initiated immediately after a blockchain lookup. This could indicate a C2 channel establishment.
- Educate Users: Implement ongoing security awareness training to educate users about phishing attacks, malicious installers disguised as legitimate software (like fake DBeaver installers), and the risks associated with downloading files from untrusted sources.
- Implement Strong Endpoint Security: Ensure robust antivirus/anti-malware solutions are deployed and kept up-to-date across all endpoints.
- Backup Data: Regularly back up critical data to isolated locations to minimize the impact of potential data theft or ransomware attacks.
Indicators of Compromise (IoCs):
| Type | Indicator | Description |
|---|---|---|
| SHA256 hash | 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 |
Aeternum C loader executable |
| SHA256 hash | 1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505 |
Malicious downloaded DotNetZip.dll |
| Filename | DotNetZip.dll |
Malicious payload executed by the loader |
| Filename | putty.exe |
Benign file downloaded for testing or staging |
| Filename | WmiFrameworkAPIKEYwmsnetrandomvalue.lnk |
Startup link for persistence |
| Filename | wmiframework.exe, ZrvEsJQzWQ.exe, STAAAAAS.exe |
Supporting binaries |
| Domain | api.telegram.org |
Telegram API endpoint used in DLL activity |
| Repository | hxxps://github[.]com/lencod |
Repository hosting malicious file artifacts |
| Repository | hxxps://github[.]com/Mash3Do |
Repository hosting malicious file artifacts |
| Telegram ID | -4991861036 |
Hard-coded chat ID for Telegram C2 bot |
| Telegram token | 8305917772AAHAou... |
Hard-coded Telegram bot API token |
| Contract address | 0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc |
Sample 1 Polygon smart contract |
| Contract address | 0x16dA95799CB8aB203f83e01AFC030B1217198Da4 |
Sample 1 Polygon smart contract |
| Contract address
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.