Aeternum is a persistent botnet loader that utilizes the Polygon blockchain to implement a decentralized Command and Control (C2) architecture. By embedding encrypted commands and payload locations within smart contracts and blockchain transactions, the threat actor eliminates the need for centralized C2 servers. This methodology renders standard mitigation techniques, such as DNS sinkholing or IP blocking, ineffective. The malware leverages "ClickFix" techniques for C2 domain distribution and blends malicious signaling with legitimate Web3 traffic, ensuring high resilience against law enforcement and security vendor takedown efforts.

• Campaign Overview: Decentralized Botnet Architecture
  • Utilizes the Polygon blockchain to host a distributed, immutable C2 infrastructure.
  • Functions primarily as a botnet loader to facilitate secondary malware deployment.
  • Shifts the C2 paradigm from centralized IP/Domain reliance to decentralized ledger entries.
• Technical Mechanics: Smart Contract C2
  • Encrypted commands and payload URLs are stored directly within blockchain transactions.
  • Employs smart contracts to act as automated triggers for payload execution.
  • Uses "ClickFix" techniques to distribute C2 domain information via blockchain-resident data.
• Threat Resilience: Immunity to Traditional Takedowns
  • Near-total immunity to standard mitigation due to the decentralized nature of Polygon.
  • Infrastructure remains operational and accessible as long as the blockchain network exists.
  • Enables dynamic updates to botnet instructions and targets through smart contract modifications.
• Detection & Defensive Implications
  • Malicious traffic is obfuscated within legitimate Web3 and blockchain protocol communications.
  • Standard network security monitoring (NSM) struggles to differentiate C2 signals from valid Web3 traffic.
  • Requires advanced behavioral analysis and blockchain-aware security telemetry for effective detection.