Void Botnet Leverages Ethereum Smart Contracts for Resilient C2

Key Takeaways

• A new botnet, Void Botnet, is leveraging Ethereum smart contracts for its command-and-control (C2) infrastructure, making it highly resilient to traditional takedown efforts.
• The botnet, written in Rust, offers a dual C2 mode: a decentralized blockchain channel for resilience and a direct web panel for faster operations.
• Advertised on Russian cybercrime forums since March 2026, Void Botnet is sold as a loader for $600 with an additional $50 per build, indicating a growing trend in blockchain-based malware.
• Qrator Labs researchers identified the botnet, noting its developer, “TheVoidStl” (alias “nikoniko”), is linked to a portfolio of other malware, including TheVoidStealer and WallStealer.

A novel and formidable threat, the Void Botnet, has emerged, distinguishing itself by utilizing Ethereum smart contracts for its command-and-control (C2) operations. This innovative approach effectively shields its infrastructure from traditional law enforcement takedown attempts, as commands are routed through a decentralized blockchain rather than vulnerable centralized servers.

First advertised in March 2026 on a prominent Russian-language cybercrime forum, the Void Botnet is available as a ready-to-deploy loader. Its pricing model includes a base cost of $600, with an additional $50 fee for each build. This accessibility on underground markets underscores its growing presence within the cybercriminal ecosystem.

The timing of Void Botnet’s appearance is particularly notable, surfacing just one month after the exposure of a similar blockchain-based C2 tool, Aeternum C2. This rapid succession of independently developed botnets, each employing different blockchains, signals a significant strategic shift among cybercriminals towards enhancing the resilience and long-term survivability of their malicious operations.

Researchers at Qrator Labs identified the Void Botnet and released their findings on May 18, 2026. According to a report shared with Cyber Security News (CSN), Qrator Labs attributes the malware’s development to a threat actor operating under the handle TheVoidStl, also known by the operator alias nikoniko. This developer is associated with a broader malware portfolio, including tools such as TheVoidStealer, WallStealer, and Void Miner, indicating a persistent and expanding presence in the threat landscape.

Void Botnet Uses Ethereum Smart Contracts for Seizure-Resistant C2

The Void Botnet is engineered in Rust, resulting in a compact native binary with a file size of only 1.5 MB. It is compatible with both 32-bit and 64-bit Windows systems, enabling a diverse array of post-compromise activities. Its design prioritizes evasion and persistent connectivity, even in the face of network disruptions or defensive countermeasures.

This botnet facilitates various malicious activities, including Distributed Denial of Service (DDoS) attacks, credential harvesting, and proxy-as-a-service operations. The integration of its C2 channel onto a public blockchain poses a significant challenge for defenders, as conventional methods like server seizure or domain suspension are rendered ineffective. Consequently, robust proactive security measures, such as anti-bot protection and DDoS mitigation, are becoming increasingly vital for organizations confronting this evolving threat.

At its core, the Void Botnet features a sophisticated dual-mode command-and-control system encapsulated within a single binary. In its decentralized mode, the botnet operator issues instructions by writing them to an Ethereum smart contract. Infected machines then periodically query this contract, typically receiving new tasks within three to five minutes. This blockchain-native command structure means there is no central server to target, no domain to block, and no registrar to contact, rendering the C2 infrastructure largely impervious to conventional law enforcement intervention.

The second mode allows for direct connections between compromised machines and the operator’s web panel, facilitating task completion in under thirty seconds. The operator possesses the flexibility to switch between these two modes by updating the smart contract. This adaptable design enables attackers to prioritize speed when conditions are favorable and revert to the highly resilient blockchain channel when protection against takedown attempts is paramount.

Inside the Operator Panel and Task Capabilities

The operator panel provides purchasers with a comprehensive overview of each compromised machine. This includes details such as geographical location, operating system, installed antivirus software, and whether the user possesses administrator privileges. Tasks can be distributed to individual machines or to the entire botnet simultaneously, with optional country-based filtering to enable highly targeted campaigns.

The panel supports fourteen distinct task types. Payloads can be delivered as executables, DLLs, MSI packages, or PowerShell scripts. A specialized in-memory execution mode allows binaries to load directly into process memory, circumventing defenses that rely on disk-based scanning. Furthermore, reverse shell and PowerShell tasks enable live, interactive sessions on compromised systems, while SelfDelete and SelfUpdate functions provide operators with the ability to remotely remove or refresh the botnet agent. Persistence is established via a scheduled task, a feature introduced in the v1.1 update.

Operational Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Implement robust endpoint detection and response (EDR) solutions capable of identifying anomalous process behavior and in-memory execution.
• Enhance network segmentation to limit the lateral movement of compromised systems within your environment.
• Deploy advanced anti-bot and DDoS mitigation services to protect against attacks leveraging this botnet.
• Regularly update and patch all operating systems and software to reduce the attack surface.
• Educate users on phishing and social engineering tactics, as these are common initial infection vectors for botnets.
• Monitor network traffic for connections to known cryptocurrency nodes or unusual blockchain activity that could indicate C2 communication.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.