A newly identified malware operation named Aeternum is using the Polygon blockchain as a command-and-control (C2) channel, making its infrastructure harder to remove than traditional botnets.
Instead of depending on a single server or domain, infected devices retrieve instructions from smart contracts hosted on the public blockchain.
A smart contract is a program stored on a blockchain that can hold and return data. Aeternum abuses this feature to store encrypted or plaintext C2 commands.
Because blockchain data is distributed across many public nodes, defenders cannot simply seize one server and shut down the operation.
The malware contacts public Polygon remote procedure call (RPC) endpoints using JSON-RPC requests.
It queries smart contracts with the function selector 0xb68d1809, linked to a getDomain() method. The response contains an encrypted payload, a plaintext command, or a URL leading to the next-stage infrastructure.
This design gives attackers a cheap and resilient dead-drop resolver. Operators can update C2 details by writing new values to their smart contracts, while infected systems continue polling public blockchain services for fresh instructions.
Aeternum Botnet Exploits Polygon
The main Aeternum loader is a UPX-packed 32-bit Windows executable written in C++. It establishes persistence by copying itself into a folder under AppData\Local and creating a shortcut in the Windows Startup directory.
The shortcut uses a misleading filename such as Wmi_Framework_APIKEY_wmsnet_<random>.lnk.
Before executing its main routines, the malware performs multiple checks intended to detect antivirus products, debuggers and virtual machines. Such checks help attackers avoid automated sandboxes and security researchers.
The loader decrypts configuration strings hidden with XOR obfuscation. These strings include Polygon RPC endpoints, file extensions, HTTP headers, smart-contract methods and C2-related commands.
It then sends HTTP POST requests to Polygon endpoints and asks contracts for instructions.
Researchers found that the loader’s encryption is weak. It uses PBKDF2HMAC and AES-GCM, but the password is also used as the salt.
This predictable design allows analysts to recover commands when they know the contract address and encrypted payload.
One decrypted command instructed infected hosts to download a file from a remote location. In one case, the malware downloaded a legitimate PuTTY installer alongside a malicious DotNetZip.dll file from GitHub-hosted repositories.
The clean file may serve as a decoy or staging component, while the DLL performs the malicious activity.
The DLL communicates with Telegram’s API using hard-coded bot details. It collects system information, including CPU, RAM, disk, GPU, administrator privileges and User Account Control status.
It can also capture screenshots and send the collected data through Telegram’s sendDocument API method.
Using legitimate services such as GitHub, Telegram and public blockchain RPC endpoints helps the attackers blend into normal web traffic.
It also forces defenders to examine the behavior and content of requests instead of blocking a single suspicious domain, unit42 said.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 | Aeternum C++ loader (Build.exe) |
| SHA-256 | 1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505 | Malicious DotNetZip.dll pay |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 channel, making its){kind=link}