Cybersecurity researchers have identified a new botnet loader called Aeternum C2 that leverages the Polygon blockchain to store encrypted command-and-control (C2) instructions. This technique, documented by Qrator Labs and Outpost24’s KrakenLabs, makes the infrastructure highly resilient to traditional law enforcement takedowns.

Key Features of Aeternum C2

• Blockchain Integration: Unlike traditional botnets using central servers, Aeternum writes instructions to the Polygon blockchain via smart contracts.
• Encrypted Commands: C2 communications are stored as encrypted logs on the public ledger; only infected machines possess the keys to decrypt and execute them.
• Resilience: Because the blockchain is decentralized and immutable, authorities cannot “seize” the server or suspend a domain to kill the network.
• Commercial Availability: The malware is sold on underground forums by a threat actor named LenAI for roughly $200, according to reports on The Hacker News.
• Loader Capabilities: It is a native C++ loader that allows operators to manage infections via a dashboard to select specific smart contracts and payload URLs.

Operational Impact

• Elimination of Weak Points: By removing traditional IP addresses, the botnet bypasses standard disruption methods used by INTERPOL or Europol against previous threats.
• Visibility vs. Security: While the blockchain provides permanence, researchers can sometimes decrypt these public logs to analyze historic command patterns.
• Stealth: Connections to legitimate blockchain infrastructure can blend in with standard decentralized application traffic, making detection via Cisco Umbrella or similar DNS filters more difficult.