Reported by 2 outlets

Timeline

1. update from gbhackers.com

   Aeternum Operators Use Polygon Smart Contracts to Rotate Malware C2 Domains Dynamically

   gbhackers.com · 54d ago · August 20th, 2026

   Aeternum operators are abusing Polygon smart contracts as a decentralized dead-drop resolver, allowing malware to retrieve and rotate command-and-control (C2) domains without depending on conventional attacker-owned servers. The approach turns a public blockchain into resilient C2 infrastructure that is substantially harder to disrupt through domain seizures, hosting takedowns, or sinkholing. Rather than contacting a fixed […] The post Aeternum Operators Use Polygon Smart Contracts to Rotate Malware C2 Domains Dynamically appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Aeternum Botnet Hides C2 Infrastructure in Polygon Smart Contracts to Evade Takedowns

   cyberpress.org · 54d ago · August 20th, 2026

   Security researchers have uncovered Aeternum , a C++-based botnet loader that uses the Polygon blockchain to host command-and-control (C2) instructions. Rather than relying on traditional servers and domains, the malware retrieves commands from smart contracts, making the operation harder to disrupt through conventional takedowns. A smart contract is a program stored and executed on a blockchain. In Aeternum’s case, attackers use these contracts as a decentralized dead-drop service for infected devices. The malware sends JSON-RPC requests to public Polygon Remote Procedure Call (RPC) endpoints, reads a contract value and then retrieves instructions or C2 domains. This model gives operators a resilient and low-cost infrastructure. Even if security teams block one malicious domain or server, attackers can update the information stored in another smart contract and redirect compromised machines. The campaign also uses anti-analysis checks, virtual-machine detection and antivirus discovery to avoid security tools. Aeternum Botnet Uses Polygon The primary Aeternum loader is a UPX-packed 32-bit Windows executable written in C++. It establishes persistence by copying itself into the user’s AppData directory and creating a disguised Windows Startup shortcut. This allows the malware to run again whenever the device restarts. After execution, Aeternum contacts Polygon RPC services and queries smart contracts using the 0xb68d1809 function selector, linked to a getDomain() method.