The Permanent Threat: Analyzing Blockchain-Based C2 Operations and Communications

Aeternum is a C++ botnet loader utilizing the Polygon blockchain for command-and-control infrastructure instead of traditional centralized servers. Threat actors write encrypted and plaintext instructions directly to smart contracts, which infected devices query via public RPC endpoints. The malware implements weak PBKDF2HMAC/AES-GCM encryption with self-salting passwords, allowing payload decryption using only the smart contract address. Analysis reveals three related samples: the core Aeternum loader with Telegram-based exfiltration, a blended threat combining XWorm RAT with XMRig cryptocurrency miner, and Python source code revealing anti-analysis checks and cryptocurrency wallet targeting. The botnet demonstrates resilience through decentralized infrastructure, making traditional law enforcement takedowns significantly more challenging while maintaining low operational costs for attackers.

• Canto incognito: tracking the PoeLLM malwareMalware2026-10-08
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03
• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run AttacksMalware2026-10-21
• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14