Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Summary: Unit 42 analyzed Aeternum, a C++ botnet loader that moves command-and-control entirely onto the public Polygon blockchain, writing encrypted and plaintext instructions through smart contracts that infected devices retrieve by querying public RPC endpoints. Across three samples, the loader used 22 different smart contract addresses, dropped a legitimate PuTTY 0.83 installer and a malicious DotNetZip.dll from GitHub, exfiltrated system data to Telegram's API with a hard-coded chat_id and bot token, and in one case also dropped an XWorm client and an XMRig cryptocurrency miner configured from a Pastebin URL.

Bottom line: Because commands live on a public blockchain rather than a server or domain, the takedown methods law enforcement has used against botnets have nothing to seize, and the loader's self-salting encryption can be broken using only the contract address and payload.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026