Reported by 1 outlet
Aeternum Botnet Runs Entire C2 Stack on the Polygon Blockchain
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Aeternum Botnet Runs Entire C2 Stack on the Polygon Blockchain
unit42.paloaltonetworks.com · 64d ago · August 11th, 2026
Unit 42 analyzed Aeternum, a C++ botnet loader that shifts command-and-control entirely to the public Polygon blockchain, with operators writing encrypted and plaintext instructions directly into smart contracts that infected devices query via public RPC endpoints. The design eliminates centralized servers and domains, making infrastructure takedown impractical — an evolution of the EtherHiding-style blockchain C2 pattern. Aeternum also uses VM detection and antivirus scanning checks to evade analysis.
-
update from unit42.paloaltonetworks.com
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
unit42.paloaltonetworks.com · 64d ago · August 10th, 2026
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42 .