Loading story…
Researchers detailed Aeternum, a malware ecosystem and botnet loader that replaces traditional command-and-control servers with the Polygon blockchain, allowing infected hosts to retrieve instructions from smart contracts through public JSON-RPC endpoints. Analysis linked multiple samples, including a C++ loader and a Python variant, through shared smart-contract architecture and the selector 0xb68d1809 used to call getDomain(). The malware also employs anti-analysis measures such as virtual-machine detection, debugger checks, and persistence via Windows Startup shortcuts, indicating an effort to survive disruption and evade investigation.
The observed infection chain delivered additional payloads including XWorm and XMRig, while also stealing host data. One sample downloaded a malicious DotNetZip.dll from GitHub and exfiltrated information through the Telegram Bot API using hard-coded bot credentials and chat IDs; another used blockchain-delivered commands to fetch XMRig configuration from Pastebin, deploy a miner and remote-access malware, and send encrypted stolen data to 193.221.200[.]219. Researchers said the linked tooling and operator activity point to an evolving, decentralized malware operation associated with the moniker LenAI.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that it had recorded more than 29,000 detection events مرتبط with the Aeternum campaign by June 4, 2026. The figure indicated the blockchain-backed malware operation was active at meaningful scale in the wild.
Researchers also analyzed a third sample consisting of Python source code that contained Aeternum logic. This variant helped reveal broader infection-chain behavior and fallback logic across the malware ecosystem.
The second sample decrypted and executed an embedded payload, then dropped XWormClient.exe and an XMRig miner executable. It also exfiltrated encrypted data over HTTP POST to 193.221.200[.]219 using a custom routine based on AES-128 ECB with zero padding.
A second analyzed sample, XBinderOutput_protected.exe, queried the Polygon blockchain using Aeternum’s command values and received a plaintext command that decoded to a Pastebin raw URL. That URL returned XMRig miner configuration data for follow-on activity.
The Build.exe sample downloaded a legitimate PuTTY installer and a malicious DotNetZip.dll from GitHub repositories. After execution, the DLL connected to the Telegram Bot API and exfiltrated host information and a screenshot using hard-coded bot credentials and chat identifiers.
One analyzed sample, a UPX-packed Windows PE named Build.exe, was observed polling 22 Polygon smart contract addresses and using the selector 0xb68d1809 to retrieve commands. It established persistence via a Startup shortcut and executed supporting binaries after deobfuscating configuration data.
Researchers analyzed three linked Aeternum samples and found a malware ecosystem that uses Polygon smart contracts and public JSON-RPC endpoints for decentralized command-and-control. The analysis tied together a C++ loader, a second-stage package deploying XWorm and XMRig, and a Python source-code variant through shared smart-contract architecture and operator activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceunit42.paloaltonetworks.com
Open sourceqrator.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a new botnet loader, **Aeternum C2**, that replaces traditional C2 servers/domains with commands written into **smart contracts on the public Polygon blockchain**, making the infrastructure difficult to disrupt via conventional takedowns. Infected hosts poll the blockchain by querying public **RPC endpoints** to retrieve instructions, which are issued as blockchain transactions and become effectively persistent once confirmed. The malware is a native **C++** loader with both x86 and x64 builds and is operated through a web-based panel that lets an operator choose a contract, select command types, and set payload URLs/targets. Reporting attributes the tooling to a threat actor known as **LenAI**, who advertised access to the malware and panel on underground forums (initially around **$200**) and later attempted to sell the broader toolkit for a higher price (including claims of offering the full codebase at a premium). The loader includes **anti-analysis/anti-VM checks** and features intended to help evade detection (e.g., build scanning to avoid antivirus flags), while keeping operating costs low (on the order of **~$1 in MATIC** for roughly **100–150** command transactions). The technique follows prior precedent of blockchain-assisted botnet C2 (e.g., **Glupteba** using Bitcoin as a fallback mechanism), but Aeternum’s use of Polygon smart contracts is positioned as a more durable, “permanent” C2 channel.
Jun 29, 2026
Security researchers and Italy’s national cyber agency warned of active **ClickFix** and **TerminalFix** malware campaigns that trick users into manually launching malicious Windows commands from fake CAPTCHA or verification pages. The activity relies on compromised legitimate websites, including WordPress sites, where obfuscated JavaScript redirects visitors to prompts telling them to open **Run**, **Windows Terminal**, or **PowerShell** and paste attacker-supplied commands. Those commands abuse trusted Windows utilities such as `powershell.exe`, `cmd.exe`, `mshta.exe`, `rundll32.exe`, `msiexec.exe`, `curl.exe`, WMI, WebDAV, and scheduled tasks to download follow-on payloads, establish persistence, and contact attacker infrastructure. Researchers said the operators are using **EtherHiding** to conceal parts of their delivery chain inside smart contracts on public blockchains, including **BNB Smart Chain** and **Polygon**, which are queried through RPC gateways to retrieve configuration or malicious instructions. WatchGuard linked one cluster to the **ErrTraffic** malware-as-a-service operation and reported delivery of payloads including **Vidar**, **Okobot**, **ClipBanker** variants, **BabaDedaLoader**, Node.js backdoors, OnionDrop-related malware, and LegionLoader-linked samples. The campaign is aimed at credential theft, browser and cookie harvesting, cryptocurrency-wallet theft, defense evasion, lateral movement, and staging for broader compromise, prompting defenders to tighten command-line controls, increase PowerShell and endpoint monitoring, isolate affected hosts, and reset exposed accounts.
Aug 11, 2026
Attackers are using cloned GitHub repositories that impersonate AI and developer tools to infect users with a multi-stage **SmartLoader** chain that ends in infostealer deployment, according to reporting from Netskope Threat Labs and related indicator data. The campaign targets AI users and developers, with observed victim concentration in North America, Asia, and Southern Europe, particularly across financial services, banking, and technology organizations. Netskope said the final payload includes a previously reported NodeJS-based Malware-as-a-Service infostealer, turning developer interest in AI tooling into a potential enterprise initial-access vector. The infection chain relies on Windows-hosted Lua components packaged in ZIP archives and staged through files including `lua51.dll`, a renamed interpreter such as `compiler.exe`, `Application.bat`, obfuscated Lua payloads such as `dist.lua`, and follow-on executables including `7d7752.exe`. Both SmartLoader stages reportedly retrieve command-and-control data dynamically from a Polygon blockchain smart contract using **EtherHiding**, with supporting indicators showing Polygon RPC endpoints, `eth_call` activity, an Ethereum-style wallet address, and GitHub-hosted files tied to accounts including `yawalinte` and `JuliusMAAR`. Netskope also found signs of **Prometheus** obfuscation in the first-stage Lua payload and **MoonSec V3**-style obfuscation in the second stage, indicating a resilient loader design that lets operators rotate C2 infrastructure without changing malware code.
Aug 4, 2026