Threat Intel·Cyber Security Blog·Aug 10, 2026·By Albert LaScola

Aeternum Shows Why Blockchain-Based C2 Is a Practical Defense Problem

Aeternum uses Polygon smart contracts, GitHub staging, and Telegram exfiltration to make botnet command-and-control more resilient. Here is what SMBs and government contractors should watch for.

Source: Unit 42, “The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications”.

Unit 42’s latest Aeternum research is a good reminder that command-and-control is no longer limited to domains, VPS infrastructure, or throwaway cloud accounts. Aeternum moves part of that control plane onto the public Polygon blockchain, where infected Windows systems can query public RPC endpoints and read commands from smart contracts. That makes the operation cheaper to run, harder to remove, and awkward for defenders who still treat “C2” as a simple domain-blocking problem.

What Unit 42 Found

Aeternum is described as a C++ botnet loader that establishes persistence, performs host reconnaissance, and then pulls instructions from Polygon smart contracts. Instead of beaconing to a traditional C2 server, the loader sends JSON-RPC requests to public Polygon RPC infrastructure. The smart contract response contains command data that the malware can decrypt and act on.

Unit 42 analyzed multiple related samples and activity paths, including:

A Windows loader that persists through the user’s Startup folder and retrieves commands from Polygon-based smart contracts.
Payload staging through GitHub-hosted files, including a malicious DLL paired with legitimate-looking tooling.
Telegram API usage for exfiltration from infected hosts.
A separate blended intrusion chain involving XWorm RAT, XMRig cryptocurrency mining, and data theft.

The practical takeaway is that Aeternum is not just “malware using crypto buzzwords.” It is an example of adversaries using public, resilient infrastructure as part of the operational stack: blockchain for command retrieval, GitHub for payload staging, Telegram for exfiltration, and commodity malware for access and monetization.

Why Blockchain-Based C2 Changes the Defender’s Problem

Traditional C2 takedowns often depend on removing or blocking attacker-controlled domains, servers, or hosting accounts. Aeternum complicates that model. If commands are stored in a public smart contract and bots can query widely used RPC endpoints, there may be no single attacker-owned server to seize. Blocking the entire public service is often unrealistic because legitimate applications may rely on the same ecosystem.

That creates a defensive tension: the infrastructure looks “trusted enough” at the domain layer, while the malicious behavior is visible in the pattern, payload, and endpoint context. For small businesses and government contractors, this matters because commodity security stacks may allow traffic to well-known services unless the endpoint and network telemetry are correlated.

What to Watch For

A few detection angles stand out from Unit 42’s analysis:

Unexpected JSON-RPC traffic from user workstations. Most accounting, HR, engineering, and admin endpoints should not be making Polygon RPC calls. Treat that as suspicious unless there is a known business reason.
Startup-folder persistence combined with unusual AppData execution. Aeternum’s persistence path is not exotic, but it is effective. Monitor new shortcuts and binaries launched from user-writable locations.
GitHub downloads followed by DLL execution. GitHub is heavily used by legitimate developers, which is exactly why attackers abuse it. Non-developer endpoints pulling executables or DLLs from raw repositories deserve scrutiny.
Telegram API traffic from servers or user endpoints. Telegram may be legitimate in some environments, but outbound bot API usage from corporate endpoints is a strong investigation candidate.
Miner and RAT behaviors in the same chain. XMRig activity is often treated as low-priority “resource theft,” but in this case it appears alongside remote access and data exfiltration behavior.

Defensive Actions for SMBs and Gov Contractors

This is the kind of threat where basic hygiene still matters, but it needs to be paired with better egress awareness.

Baseline outbound traffic. Know which systems actually need GitHub, Telegram, Pastebin, public blockchain RPC endpoints, and other developer or messaging platforms.
Block or alert on high-risk services by role. A developer workstation may need GitHub. A finance laptop probably does not need to download DLLs from it. A file server should not be talking to Telegram’s bot API.
Monitor user-writable execution paths. AppData, Temp, Downloads, and Startup folder changes should be visible in EDR or logging.
Use DNS and HTTP telemetry together. Domain allowlists alone will miss this class of abuse. Look at URL paths, request methods, user agents, process lineage, and destination category.
Separate “allowed service” from “allowed behavior.” Public infrastructure can be abused. Treat GitHub, Telegram, Pastebin, and blockchain RPC as services that require context, not automatic trust.
Hunt for commodity payload overlap. Look for XWorm indicators, miner process names, suspicious process injection, and security-tool termination attempts.

Bulwark Black Assessment

Aeternum is a useful case study because it shows where cyber defense is headed: not necessarily more sophisticated malware on every host, but more resilient abuse of public infrastructure around the host. The loader, persistence, and payload execution are familiar. The durable command layer is the twist.

For smaller organizations, the answer is not to become blockchain experts overnight. The answer is to get serious about endpoint visibility, role-based egress controls, and alerting on unexpected use of public platforms. If your network cannot explain why a workstation is querying blockchain RPC endpoints, pulling binaries from GitHub, and talking to Telegram APIs, you have a hunting lead worth pursuing.

Read the original Unit 42 research here: The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications.

Indicators of Compromise

97 indicators, auto-extracted and defanged.

TXT CSV JSON YARA

IPv4 (1)

193[.]221[.]200[.]219

Domains (24)

api[.]noderpc[.]xyzapi[.]telegram[.]orgapi[.]zan[.]topdev[.]todownload[.]sfxp-api-group-wechat[.]comendpoints[.]omniatech[.]iogateway[.]fmgateway[.]tenderly[.]copolygon-amoy[.]gateway[.]tenderly[.]copolygon-amoy[.]therpc[.]iopolygon-mainnet[.]g[.]alchemy[.]compolygon-mumbai-bor-rpc[.]publicnode[.]compolygon-mumbai[.]g[.]alchemy[.]compolygon-mumbai[.]gateway[.]tenderly[.]copolygon-pokt[.]nodies[.]apppolygon-zkevm-mainnet[.]public[.]blastapi[.]iopolygon-zkevm[.]drpc[.]orgpolygon[.]rpc[.]hypersync[.]xyzpolygontestapi[.]terminet[.]iorpc[.]polygon-zkevm[.]gateway[.]fmrpc[.]polygonsupernet[.]public[.]arianee[.]netsekirolegion[.]duckdns[.]orgupdate-launcher[.]xyzupdate[.]constant-path[.]xyz

URLs (40)

alchemy[.]com/v2/demoarianee[.]netblastapi[.]ioconstant-path[.]xyzdrpc[.]orgduckdns[.]org/api/endpoint[.]phphxxp://sekirolegion[.]duckdns[.]org/api/endpoint[.]phphxxps://api[.]noderpc[.]xyz/rpc-polygon-pos/publichxxps://api[.]zan[.]top/polygon-amoyhxxps://endpoints[.]omniatech[.]io/v1/polygon-zkevm/testnet/publichxxps://gateway[.]tenderly[.]co/public/polygonhxxps://gateway[.]tenderly[.]co/public/polygon-mumbaihxxps://polygon-amoy[.]gateway[.]tenderly[.]cohxxps://polygon-amoy[.]therpc[.]iohxxps://polygon-mainnet[.]g[.]alchemy[.]com/v2/demohxxps://polygon-mumbai-bor-rpc[.]publicnode[.]comhxxps://polygon-mumbai[.]g[.]alchemy[.]com/v2/demohxxps://polygon-mumbai[.]gateway[.]tenderly[.]cohxxps://polygon-pokt[.]nodies[.]app/hxxps://polygon-zkevm-mainnet[.]public[.]blastapi[.]iohxxps://polygon-zkevm[.]drpc[.]orghxxps://polygon[.]rpc[.]hypersync[.]xyz/hxxps://polygontestapi[.]terminet[.]io/rpchxxps://rpc[.]polygon-zkevm[.]gateway[.]fmhxxps://rpc[.]polygonsupernet[.]public[.]arianee[.]nethypersync[.]xyz/noderpc[.]xyz/rpc-polygon-pos/publicnodies[.]app/omniatech[.]io/v1/polygon-zkevm/testnet/publicpublicnode[.]comrpc[.]polygon-zkevm[.]gateway[.]fmsfxp-api-group-wechat[.]comtelegram[.]orgtenderly[.]cotenderly[.]co/public/polygontenderly[.]co/public/polygon-mumbaiterminet[.]io/rpctherpc[.]ioupdate-launcher[.]xyzzan[.]top/polygon-amoy

sha256 (6)

1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce5054e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d84689881bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9fea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27

Ethereum Addresses (25)

0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc0x16dA95799CB8aB203f83e01AFC030B1217198Da40x1D50703722729dD68e89D819F69eFc5Fb206bBe70x27c7c36981c1ed5cFA2DCDb4B43C27A6BaF6bEa80x4dcE7d4b1229F3705BDB70341484cF2EEE36432e0x55b4F951d5Ac035C21B170C73C0A930a641b718C0x6da31EB2A016074ffd5519326573E78E2677E4C80x737791081A398151195a753Fb49f9c1b8bc1fCDB0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B80x7D2D8A4A6E8D89cf5C151C4f68A521490D9779B00x8d2BaEc2687F59eE1EE7BFd322D33325f5E004ee0xC37fB924cF5996C9e676BBA399bDfc5F936B35720xC41342908f98E813862EDFe47Ac3af676F8098C90xCE476E6f4d83a7a086Cbcdf0FE2E8f221e47e81C0xD69A36439FffD145ADAcacB94fDe6f8b3546a3610xFDB8b139EeacD17ea7c10c256eA77Ba6Dff18D7d0xFdfB8c4e827c2d053749C8F2f2058548dde0d0730xb0874252a7359AA701F3F144A1f03A6e0DA8aE6D0xb3EF2D08Bf25a7daB9d8b98d64E564eA1f6Db9240xb8fB2bfb182A172b29C365AD6CF743449975C4180xbD6e817Cc510EC3DA5651B5a3AC595d34C0CF1af0xc7199C1dbCd82c4E002327Aa3EC9158F434a6aCE0xcaf2c54e400437da717cf215181b170f65187abf0xf9438b4E3200AE1611eD3d03310c803FDdf676720xfbC267200f9e5749045f32dbB55BB16615f1CE5F

Monero Addresses (1)

82pNS8tBnvZ5cmV1iU9cXdQmhGz95P18fZpASBrxtaSF1ToTmZtf3HGHrdXMt1Znuu8BLU17koPs2hTXxTajdTviLcgbbAi

Auto-extracted from this report. Indicators shown are defanged for safe viewing. The downloads contain live values plus a YARA rule for tooling. Verify before acting.

Shares infrastructure with

These reports reuse the same indicators, so they are likely the same campaign or actor toolkit. See all clusters →

Shared indicators

api[.]telegram[.]orgdrpc[.]orgpolygon-pokt[.]nodies[.]apppublicnode[.]comtelegram[.]org