Loading story…
Researchers disclosed a new botnet loader, Aeternum C2, that replaces traditional C2 servers/domains with commands written into smart contracts on the public Polygon blockchain, making the infrastructure difficult to disrupt via conventional takedowns. Infected hosts poll the blockchain by querying public RPC endpoints to retrieve instructions, which are issued as blockchain transactions and become effectively persistent once confirmed. The malware is a native C++ loader with both x86 and x64 builds and is operated through a web-based panel that lets an operator choose a contract, select command types, and set payload URLs/targets.
Reporting attributes the tooling to a threat actor known as LenAI, who advertised access to the malware and panel on underground forums (initially around $200) and later attempted to sell the broader toolkit for a higher price (including claims of offering the full codebase at a premium). The loader includes anti-analysis/anti-VM checks and features intended to help evade detection (e.g., build scanning to avoid antivirus flags), while keeping operating costs low (on the order of ~$1 in MATIC for roughly 100–150 command transactions). The technique follows prior precedent of blockchain-assisted botnet C2 (e.g., Glupteba using Bitcoin as a fallback mechanism), but Aeternum’s use of Polygon smart contracts is positioned as a more durable, “permanent” C2 channel.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Separate reporting from Infrawatch described DSLRoot, an underground residential proxy service that deploys dedicated laptop hardware in U.S. homes and uses a Delphi tool called DSLPylon to manage modems and Android devices via ADB. The network was attributed to Belarusian national Andrei Holas and estimated to operate about 300 devices across more than 20 U.S. states.
Public reporting detailed that Aeternum is available in 32-bit and 64-bit C++ builds, supports multiple smart contracts for different payloads, and includes features such as anti-VM checks, infection tracking, and Kleenscan-assisted AV evasion. Researchers also noted the low operating cost of issuing commands on Polygon using MATIC.
Qrator Labs, with reporting also citing Ctrl Alt Intel, disclosed that Aeternum stores encrypted bot commands in Polygon smart contracts and has infected hosts retrieve them through public RPC endpoints. The design makes the botnet more resistant to traditional takedown efforts because it avoids reliance on conventional domains or servers.
After marketing Aeternum C2, LenAI later tried to sell the entire project outright for $10,000. Reporting also linked LenAI to a separate crimeware tool called ErrTraffic used to automate ClickFix attacks.
A threat actor using the name LenAI advertised the Aeternum C2 botnet loader on underground forums, offering a web-based control panel and pricing tiers that included access up to full source code. The malware was described as a native C++ loader with anti-analysis and antivirus-evasion features.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcectrlaltintel.com
Open sourcectrlaltintel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Aeternum**, a malware ecosystem and botnet loader that replaces traditional command-and-control servers with the **Polygon** blockchain, allowing infected hosts to retrieve instructions from smart contracts through public JSON-RPC endpoints. Analysis linked multiple samples, including a C++ loader and a Python variant, through shared smart-contract architecture and the selector `0xb68d1809` used to call `getDomain()`. The malware also employs anti-analysis measures such as virtual-machine detection, debugger checks, and persistence via Windows Startup shortcuts, indicating an effort to survive disruption and evade investigation. The observed infection chain delivered additional payloads including **XWorm** and **XMRig**, while also stealing host data. One sample downloaded a malicious `DotNetZip.dll` from GitHub and exfiltrated information through the **Telegram Bot API** using hard-coded bot credentials and chat IDs; another used blockchain-delivered commands to fetch **XMRig** configuration from Pastebin, deploy a miner and remote-access malware, and send encrypted stolen data to `193.221.200[.]219`. Researchers said the linked tooling and operator activity point to an evolving, decentralized malware operation associated with the moniker **LenAI**.
Aug 14, 2026
Attackers are using cloned GitHub repositories that impersonate AI and developer tools to infect users with a multi-stage **SmartLoader** chain that ends in infostealer deployment, according to reporting from Netskope Threat Labs and related indicator data. The campaign targets AI users and developers, with observed victim concentration in North America, Asia, and Southern Europe, particularly across financial services, banking, and technology organizations. Netskope said the final payload includes a previously reported NodeJS-based Malware-as-a-Service infostealer, turning developer interest in AI tooling into a potential enterprise initial-access vector. The infection chain relies on Windows-hosted Lua components packaged in ZIP archives and staged through files including `lua51.dll`, a renamed interpreter such as `compiler.exe`, `Application.bat`, obfuscated Lua payloads such as `dist.lua`, and follow-on executables including `7d7752.exe`. Both SmartLoader stages reportedly retrieve command-and-control data dynamically from a Polygon blockchain smart contract using **EtherHiding**, with supporting indicators showing Polygon RPC endpoints, `eth_call` activity, an Ethereum-style wallet address, and GitHub-hosted files tied to accounts including `yawalinte` and `JuliusMAAR`. Netskope also found signs of **Prometheus** obfuscation in the first-stage Lua payload and **MoonSec V3**-style obfuscation in the second stage, indicating a resilient loader design that lets operators rotate C2 infrastructure without changing malware code.
Aug 4, 2026
Researchers linked the **Remus** infostealer to an evolving command-and-control architecture that stores live resolver data in **Ethereum smart contracts**, extending the malware’s use of EtherHiding beyond earlier Telegram and Steam dead-drop methods. Analysis of contract `0x999941b74F6bbc921D5174A5b29911562cd2D7CF` and its `0xc2fb26a6` function exposed a live C2 domain, `fightwa[.]biz:5902`, which had not appeared in prior public indicators; historical activity showed the infrastructure rotating from a test domain to `chalx[.]live:5902` and then to `fightwa[.]biz:5902`. The domain resolved to `185.53.179.128`, an IP already associated with Remus infrastructure, and researchers said monitoring blockchain `DomainUpdated` events could provide durable visibility into future C2 changes. Separate infrastructure mapping found the campaign spread across more than 15 ASNs but concentrated at **Hostinger International Limited** (`AS47583`) and **Team Internet AG** (`AS206834`), with `185.53.179.128` standing out as a likely convergence or exfiltration node. Investigators identified **five** Ethereum contracts used to hold live C2 data, showing a progression from simple `DomainStorage` designs to more controlled and stealthier `DataStore` variants, while malware analysis described Remus as a likely **Lumma-derived** 64-bit stealer that steals browser credentials, cookies, and cryptocurrency wallets. The malware also inherits Lumma’s browser-memory technique for bypassing Chromium **Application-Bound Encryption**, while adding compact shellcode, randomized hidden-browser desktop names, anti-analysis checks, and blockchain-backed C2 resilience.
Jul 2, 2026