Reported by 2 outlets

Timeline

1. original reporting

   Aeternum Botnet Uses Polygon Blockchain Smart Contracts for Takedown-Resistant C2

   cyberpress.org · 60d ago · August 14th, 2026

   A newly identified malware operation named Aeternum is using the Polygon blockchain as a command-and-control (C2) channel, making its infrastructure harder to remove than traditional botnets. Instead of depending on a single server or domain, infected devices retrieve instructions from smart contracts hosted on the public blockchain. A smart contract is a program stored on a blockchain that can hold and return data. Aeternum abuses this feature to store encrypted or plaintext C2 commands. Because blockchain data is distributed across many public nodes, defenders cannot simply seize one server and shut down the operation. The malware contacts public Polygon remote procedure call (RPC) endpoints using JSON-RPC requests. It queries smart contracts with the function selector 0xb68d1809 , linked to a getDomain() method. The response contains an encrypted payload, a plaintext command, or a URL leading to the next-stage infrastructure. This design gives attackers a cheap and resilient dead-drop resolver. Operators can update C2 details by writing new values to their smart contracts, while infected systems continue polling public blockchain services for fresh instructions. Aeternum Botnet Exploits Polygon The main Aeternum loader is a UPX-packed 32-bit Windows executable written in C++ . It establishes persistence by copying itself into a folder under AppData\Local and creating a shortcut in the Windows Startup directory. The shortcut uses a misleading filename such as Wmi_Framework_

2. update from gbhackers.com

   Aeternum Hides Malware Commands on Polygon Blockchain Where Server Takedowns Can’t Erase Them

   gbhackers.com · 60d ago · August 14th, 2026

   A newly analyzed malware operation called Aeternum is turning the public Polygon blockchain into a command-and-control (C2) channel, allowing attackers to distribute botnet instructions without relying on a conventional server or domain. The design shifts a core defensive assumption: seizing infrastructure may disrupt payload hosting, but it cannot remove commands that have already been committed […] The post Aeternum Hides Malware Commands on Polygon Blockchain Where Server Takedowns Can’t Erase Them appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .