The Permanent Threat: Analyzing Blockchain-Based C2 Operations and Communications
Aeternum is a C++ botnet loader utilizing the Polygon blockchain for command-and-control infrastructure instead of traditional centralized servers. Threat actors write encrypted and plaintext instructions directly to smart contracts, which infected devices query via public RPC endpoints. The malware implements weak PBKDF2HMAC/AES-GCM encryption with self-salting passwords, allowing payload decryption using only the smart contract address. Analysis reveals three related samples: the core Aeternum loader with Telegram-based exfiltration, a blended threat combining XWorm RAT with XMRig cryptocurrency miner, and Python source code revealing anti-analysis checks and cryptocurrency wallet targeting. The botnet demonstrates resilience through decentralized infrastructure, making traditional law enforcement takedowns significantly more challenging while maintaining low operational costs for attackers.
AI Analysis
Technical Summary
Aeternum is a sophisticated botnet loader written in C++ that leverages the Polygon blockchain to implement a decentralized command-and-control infrastructure. Instead of using traditional centralized C2 servers, the malware operators write commands—both encrypted and plaintext—directly into smart contracts on the blockchain. Infected devices query these smart contracts through public RPC endpoints to receive instructions. The encryption scheme uses PBKDF2HMAC with AES-GCM but is weak due to self-salting passwords, allowing payload decryption with knowledge of only the smart contract address. Three related samples were analyzed: the core Aeternum loader featuring Telegram-based exfiltration, a combined threat integrating the XWorm RAT with the XMRig cryptocurrency miner, and Python source code that includes anti-analysis checks and targets cryptocurrency wallets. The use of blockchain-based C2 infrastructure provides the botnet with high resilience against traditional law enforcement takedowns and lowers the attackers' operational costs.
Potential Impact
The decentralized blockchain-based C2 infrastructure makes the botnet highly resilient against takedown attempts, complicating traditional law enforcement and incident response efforts. The malware facilitates data exfiltration via Telegram and enables cryptocurrency mining on infected hosts, potentially leading to resource exhaustion and financial loss. The weak encryption scheme may allow defenders to decrypt payloads if the smart contract address is known, but the overall architecture increases the difficulty of disrupting the botnet's operations.
Mitigation Recommendations
No official patch or remediation is available as this is malware leveraging decentralized infrastructure. Traditional takedown methods are less effective due to the use of blockchain smart contracts for C2. Defenders should focus on detection and blocking of the malware payloads, monitoring for indicators of compromise related to Aeternum, and applying endpoint protections to prevent infection. Network defenses should consider monitoring for unusual RPC calls to Polygon blockchain endpoints. Since no vendor advisory or patch information is provided, patch status is not yet confirmed—check vendor or threat intelligence advisories for updates.
Indicators of Compromise
- domain: endpoints.omniatech.io
- domain: polygon-zkevm.drpc.org
- ip: 193.221.200.219
- domain: cdnjsdelivr.beer
- domain: polygon-mumbai.gateway.tenderly.co
- domain: sekirolegion.duckdns.org
- domain: api.zan.top
- hash: 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898
- hash: 1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505
- url: https://rpc.polygon-zkevm.gateway.fm
- hash: f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27
- hash: 4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f
- hash: 81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f
- hash: ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2
- domain: download.sftp-api-group-wechat.com
- domain: update.constant-path.xyz
- domain: update-launcher.xyz
- domain: test-steve.cyou
- hash: 673a51a179a78fbdf2b8770f868f883a
- hash: 848b1440f5f52bfddf2e1b3e9e248f12
- hash: a45e8679d2695d10a45a3f78268fab64
- hash: 96f6794fa4b7414e38be4ef497cd8611d50a59ec
- hash: d224dde23da2faff57235192333fc7998762c645
- hash: d3e0f9448c94b1017f26e4da63b710a886a2b426
- domain: api.noderpc.xyz
- domain: polygon-amoy.gateway.tenderly.co
- domain: polygon-amoy.therpc.io
- domain: polygon-mumbai-bor-rpc.publicnode.com
- domain: polygon-zkevm-mainnet.public.blastapi.io
- domain: polygon.rpc.hypersync.xyz
- domain: polygontestapi.terminet.io
- domain: rpc.polygon-zkevm.gateway.fm
- domain: rpc.polygonsupernet.public.arianee.net
- domain: rpc.poolz.finance
- hash: 1ef50e9d715245e29220936a66c0bece
- hash: 66575cc1df33e40a47fe00abdc067fe5
- hash: cd8b231a2101c7de3f0b118f99279cbd
- hash: 326a4305420a5c57950a7ee8c1e41b31132dd027
- hash: b51a50ffc57565c8488cb8101252db0e60619750
- hash: cfd101963a4e791fc59bda97bfc87f33ce7ce379
The Permanent Threat: Analyzing Blockchain-Based C2 Operations and Communications
Description
Aeternum is a C++ botnet loader utilizing the Polygon blockchain for command-and-control infrastructure instead of traditional centralized servers. Threat actors write encrypted and plaintext instructions directly to smart contracts, which infected devices query via public RPC endpoints. The malware implements weak PBKDF2HMAC/AES-GCM encryption with self-salting passwords, allowing payload decryption using only the smart contract address. Analysis reveals three related samples: the core Aeternum loader with Telegram-based exfiltration, a blended threat combining XWorm RAT with XMRig cryptocurrency miner, and Python source code revealing anti-analysis checks and cryptocurrency wallet targeting. The botnet demonstrates resilience through decentralized infrastructure, making traditional law enforcement takedowns significantly more challenging while maintaining low operational costs for attackers.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Aeternum is a sophisticated botnet loader written in C++ that leverages the Polygon blockchain to implement a decentralized command-and-control infrastructure. Instead of using traditional centralized C2 servers, the malware operators write commands—both encrypted and plaintext—directly into smart contracts on the blockchain. Infected devices query these smart contracts through public RPC endpoints to receive instructions. The encryption scheme uses PBKDF2HMAC with AES-GCM but is weak due to self-salting passwords, allowing payload decryption with knowledge of only the smart contract address. Three related samples were analyzed: the core Aeternum loader featuring Telegram-based exfiltration, a combined threat integrating the XWorm RAT with the XMRig cryptocurrency miner, and Python source code that includes anti-analysis checks and targets cryptocurrency wallets. The use of blockchain-based C2 infrastructure provides the botnet with high resilience against traditional law enforcement takedowns and lowers the attackers' operational costs.
Potential Impact
The decentralized blockchain-based C2 infrastructure makes the botnet highly resilient against takedown attempts, complicating traditional law enforcement and incident response efforts. The malware facilitates data exfiltration via Telegram and enables cryptocurrency mining on infected hosts, potentially leading to resource exhaustion and financial loss. The weak encryption scheme may allow defenders to decrypt payloads if the smart contract address is known, but the overall architecture increases the difficulty of disrupting the botnet's operations.
Defensive Guidance
No official patch or remediation is available as this is malware leveraging decentralized infrastructure. Traditional takedown methods are less effective due to the use of blockchain smart contracts for C2. Defenders should focus on detection and blocking of the malware payloads, monitoring for indicators of compromise related to Aeternum, and applying endpoint protections to prevent infection. Network defenses should consider monitoring for unusual RPC calls to Polygon blockchain endpoints. Since no vendor advisory or patch information is provided, patch status is not yet confirmed—check vendor or threat intelligence advisories for updates.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/"]
- Adversary
- LenAI
- Pulse Id
- 6a7a8be76fe0dfa36d01afa0
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainendpoints.omniatech.io | — | |
domainpolygon-zkevm.drpc.org | — | |
domaincdnjsdelivr.beer | — | |
domainpolygon-mumbai.gateway.tenderly.co | — | |
domainsekirolegion.duckdns.org | — | |
domainapi.zan.top | — | |
domaindownload.sftp-api-group-wechat.com | — | |
domainupdate.constant-path.xyz | — | |
domainupdate-launcher.xyz | — | |
domaintest-steve.cyou | — | |
domainapi.noderpc.xyz | — | |
domainpolygon-amoy.gateway.tenderly.co | — | |
domainpolygon-amoy.therpc.io | — | |
domainpolygon-mumbai-bor-rpc.publicnode.com | — | |
domainpolygon-zkevm-mainnet.public.blastapi.io | — | |
domainpolygon.rpc.hypersync.xyz | — | |
domainpolygontestapi.terminet.io | — | |
domainrpc.polygon-zkevm.gateway.fm | — | |
domainrpc.polygonsupernet.public.arianee.net | — | |
domainrpc.poolz.finance | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip193.221.200.219 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 | — | |
hash1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505 | — | |
hashf2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27 | — | |
hash4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f | — | |
hash81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f | — | |
hashea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2 | — | |
hash673a51a179a78fbdf2b8770f868f883a | — | |
hash848b1440f5f52bfddf2e1b3e9e248f12 | — | |
hasha45e8679d2695d10a45a3f78268fab64 | — | |
hash96f6794fa4b7414e38be4ef497cd8611d50a59ec | — | |
hashd224dde23da2faff57235192333fc7998762c645 | — | |
hashd3e0f9448c94b1017f26e4da63b710a886a2b426 | — | |
hash1ef50e9d715245e29220936a66c0bece | — | |
hash66575cc1df33e40a47fe00abdc067fe5 | — | |
hashcd8b231a2101c7de3f0b118f99279cbd | — | |
hash326a4305420a5c57950a7ee8c1e41b31132dd027 | — | |
hashb51a50ffc57565c8488cb8101252db0e60619750 | — | |
hashcfd101963a4e791fc59bda97bfc87f33ce7ce379 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://rpc.polygon-zkevm.gateway.fm | — |
Threat ID: 6a7ad59dbf8831d5395f1ae7
Added to database: 08/11/2026, 07:56:13 UTC
Last enriched: 08/11/2026, 09:29:21 UTC
Last updated: 09/27/2026, 02:02:59 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.