Threats Tagged 'blockchain c2'

In June 2026, multiple infostealer malware families including Remus, ACRStealer, LummaC2, and Vidar were actively distributed using SEO poisoning and disguised as illegal software. The primary infection vectors were EXE files and DLL side-loading, with distribution through popular cloud storage platforms. MacOS systems were targeted via ClickFix techniques and malicious Bash scripts, including a variant using Polygon smart contracts for dynamic command and control. Email campaigns spread AgentTesla and DarkCloud malware through compressed attachments, both exfiltrating data via SMTP. The stolen credentials from these campaigns pose significant risks for illicit trading and follow-on attacks.

A ClickFix social engineering attack on an unmonitored endpoint led to a multi-stage intrusion affecting over 11 hosts. The infection chain began with a malicious HTA payload that silently installed an MSI package containing Potemkin, a custom loader with a deterministic DGA. Potemkin delivered RMMProject, a 4.4 MB Lua-scriptable RAT featuring browser credential theft with Chrome App-Bound Encryption bypass, hidden-desktop remote control, and 15 distinct task types. The attacker deployed EtherRAT, a Node.js backdoor resolving C2 addresses from Ethereum blockchain, and established a Cloudflare tunnel for persistent access. Hands-on-keyboard activity included battling Windows Defender through AMSI patches, registry modifications, and service termination, followed by lateral movement via WMIExec and SMBExec to deploy malware across the network and reach the domain controller.