Tia N.List

CTI · reported · 2026-08-11

Aeternum Botnet Runs Entire C2 Stack on the Polygon Blockchain

Full story & timeline

Actors

—

Malware / tools

Aeternum

Campaigns

—

CVEs

—

Victim sectors

—

Geography

—

MITRE ATT&CK

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Aeternum Botnet Blockchain RPC Communication
id: 6f39590d-65e5-4372-a28d-1db2f0e7b41a
status: experimental
description: >
    Detects processes communicating with public Polygon blockchain RPC
    endpoints, the command-and-control channel of the Aeternum botnet
    loader (Unit 42, 2026): infected devices query attacker-controlled
    smart contracts through public RPC endpoints instead of a central
    C2 server.
references:
    - https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/
author: Tia N. List
date: 2026/08/11
tags:
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|endswith:
            - 'polygon-rpc.com'
            - 'rpc-mainnet.matic.network'
            - 'rpc-mainnet.maticvigil.com'
            - 'polygon.llamarpc.com'
    selection_port:
        DestinationPort:
            - 8545
            - 8546
    condition: selection_domain or selection_port
falsepositives:
    - Legitimate wallets and DeFi applications using public RPC endpoints
    - Local development nodes bound to 8545/8546
level: medium

Splunk SPL raw

# aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain — Splunk SPL variant (derived from aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain.sigma via sigma convert)
# source-sha256: 470584add4ba293f97bee7bd05690b843924436b9b5801c27a7cc7470f4e4c02 v1
DestinationHostname IN ("*polygon-rpc.com", "*rpc-mainnet.matic.network", "*rpc-mainnet.maticvigil.com", "*polygon.llamarpc.com") OR DestinationPort IN (8545, 8546)

KQL (Sentinel / Defender) raw

# aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain — KQL variant (derived from aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain.sigma via sigma convert)
# source-sha256: 470584add4ba293f97bee7bd05690b843924436b9b5801c27a7cc7470f4e4c02 v1
(DestinationHostname endswith "polygon-rpc.com" or DestinationHostname endswith "rpc-mainnet.matic.network" or DestinationHostname endswith "rpc-mainnet.maticvigil.com" or DestinationHostname endswith "polygon.llamarpc.com") or (DestinationPort in~ ("8545", "8546"))

YARA-X raw

rule Aeternum_Blockchain_C2 {
    meta:
        author = "Tia N. List"
        date = "2026-08-11"
        status = "experimental"
        description = "C++ botnet loader moving command-and-control onto the public Polygon blockchain; infected devices query attacker-controlled smart contracts via public JSON-RPC endpoints. Derived from case analysis (Unit 42) — NOT validated against a live sample."
        reference = "https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/"
        falsepositives = "Wallet/DeFi applications legitimately embed the same public RPC endpoints and JSON-RPC methods; combine with process/network context before acting"
    strings:
        $rpc1 = "polygon-rpc.com" ascii nocase
        $rpc2 = "rpc-mainnet.matic.network" ascii nocase
        $rpc3 = "rpc-mainnet.maticvigil.com" ascii nocase
        $rpc4 = "polygon.llamarpc.com" ascii nocase
        $method1 = "eth_blockNumber" ascii
        $method2 = "eth_getCode" ascii
        $method3 = "eth_call" ascii
    condition:
        uint16(0) == 0x5A4D and any of ($rpc*) and any of ($method*)
}

References

Source on GitHub