In a concerning development in cybercriminal infrastructure, researchers have identified a new threat dubbed the Void Botnet.
Discovered in March 2026, just one month after the Polygon-based Aeternum C2, this malware leverages Ethereum smart contracts to maintain a highly resilient command-and-control network.
The rapid emergence of two distinct blockchain-based botnets signals a growing trend toward decentralized infrastructures that are incredibly difficult for authorities to dismantle.
Void Botnet Ethereum C2
Developed by a threat actor known as “TheVoidStl,” the Void Botnet is a Rust-native loader that offers operators a flexible, dual-mode system.
The primary mode routes encrypted commands entirely through Ethereum smart contracts.
Infected machines poll public RPC endpoints every three to five minutes to retrieve new tasks, ensuring there is no centralized server to seize or domain to suspend.
When speed is prioritized over resilience, operators can switch to a direct web panel connection that executes tasks in under 30 seconds.
The operator’s panel provides comprehensive post-compromise tools that track the location, operating system, and antivirus status of each infected machine.
Operators can deploy payloads as executables, DLLs, MSI packages, or PowerShell scripts, and even filter their targets by geographic region.
According to Qrator research, Void Botnet is equipped with an array of evasive capabilities designed to bypass traditional file-based detection mechanisms.
A dedicated in-memory execution mode loads native binaries directly into a compromised process without writing them to disk.
Attackers can also establish reverse shells for interactive access while the botnet seamlessly processes other background tasks.
The malware demonstrates behaviors aligning with several key MITRE ATT&CK techniques:
- Web Service (T1102) utilizes Ethereum infrastructure as the primary communication channel.
- Reflective Code Loading (T1620) executes binaries directly in process memory to evade file scanning.
- Command and Scripting Interpreter (T1059.001) relies on PowerShell for interactive sessions and fileless persistence.
- Scheduled Task (T1053.005) establishes system persistence via background scheduled jobs.
- Deobfuscate Files (T1140) decrypts the heavily obfuscated bot assembly at runtime.
At a price point of $600 with an additional $50 per-build fee, Void Botnet represents an accessible, commercial-grade threat.
Because there is no single point of failure to target in a takedown effort, defending against these decentralized botnets requires a proactive shift toward robust mitigation strategies at the network edge.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
