A botnet loader called Aeternum takes its marching orders from the public Polygon blockchain rather than from a server its operators have to rent and defend, and the payloads it delivers go straight after cryptocurrency: wallet logins, a remote access trojan, and a hidden Monero miner. Chris Navarrete, Sai Sathvik Ruppa and Haozhe Zhang of Palo Alto Networks' Unit 42 published a full teardown of the operation, and say the company's Advanced Threat Prevention product recorded more than 29,000 detection events as of June 4, 2026.
The appeal for the attackers is durability. A conventional command-and-control server (the machine that tells infected computers what to do) can be seized, sinkholed, or pulled offline by its hosting provider. Instructions written into a smart contract cannot: they sit on a public ledger that thousands of nodes replicate, and the malware retrieves them with ordinary web requests to public blockchain gateways, which blends into legitimate crypto traffic. IntelFusions has covered several variations on the technique already, including a 200,000-device botnet that moved its servers on-chain.
How the blockchain control channel works
Aeternum's contracts expose three functions. A getDomain() call returns the encrypted address of the current control server, an admin-only updateDomain() lets the operator rotate to a new one, and an admin() getter identifies the owner. Infected machines issue JSON-RPC requests to public Polygon endpoints, passing the contract address and the method selector, and get an encrypted blob back. Unit 42 notes that the 4-byte selector for the first function persists across every sample it examined, which makes it what the team calls a reliable cryptographic fingerprint for hunting.
The operators also made a mistake worth knowing about. The commands are protected with PBKDF2HMAC key stretching over SHA256, but the malware uses the password itself as the salt, which the researchers point out violates the NIST SP 800-132 guidance for password-based key derivation. Because the derivation is therefore predictable, anyone holding the contract address and the ciphertext can recover the plaintext commands. That is an unusual advantage for defenders and researchers, who can read the botnet's instructions off the public chain.
What lands on the machine
Unit 42 analysed three samples. The first is a UPX-packed loader that copies itself into AppData, plants a Startup shortcut for persistence, and pulls both a legitimate PuTTY 0.83 installer and a malicious DotNetZip.dll from GitHub repositories. The DLL fingerprints the host (CPU, RAM, disk, GPU, and whether UAC is on), renders the result to a screenshot, and ships it out through a hard-coded Telegram bot. Its strings are written in Russian.
The second bundles the XWorm remote access trojan with the XMRig cryptocurrency miner, pulling the mining configuration from a Pastebin link that the smart contract hands back. That configuration points at the gulf[.]moneroocean[.]stream pool and switches on options that blocklist process-monitoring utilities and kill security software competing for CPU. Unit 42 says certain behaviour and network patterns match ZingoStealer, reported by Cisco Talos in April 2022, but is explicit that it cannot fully attribute the activity to it.
The third arrives as a fake DBeaver installer and is the most careful of the set: it checks for sandbox usernames, refuses to run on machines with less than 8 GB of RAM, and looks for Zone.Identifier markers in the Downloads folder to confirm it is not sitting on a pristine analysis VM. It then injects itself into the signed Windows binary dpapimig.exe using Early Bird APC injection, and carries hard-coded routines to harvest credentials from over 55 cryptocurrency browser extensions and 10 desktop wallets.
By tracing transactions to the admin-only rotation function, the researchers tied the operation to a handle they identify as LenAI, still actively swapping in new control domains. Comparing the compiled contract bytecode across samples shows the compiler moving from solc 0.8.0 to 0.8.30 with steady gas optimisation, which Unit 42 reads as the same codebase being refined and redeployed over time rather than abandoned.
What you should do
Workstations have very little reason to be making JSON-RPC calls to public blockchain gateways, so that traffic is a strong hunting signal on a corporate network even though it is perfectly legitimate elsewhere. Audit Startup folder shortcuts for entries pointing into AppData, treat outbound Telegram bot API traffic from non-user applications as suspect, and watch for miner behaviour on endpoints that should never be mining. Palo Alto Networks customers are covered by Threat Prevention signatures 87116 and 87152, and the firm says its WildFire models have been updated for these indicators.
Indicators
- Loader (Build.exe):
5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 - XWorm client:
4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f - XMRig miner:
81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f - Python sample:
ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2 - Smart contracts:
0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B8,0xb0874252a7359AA701F3F144A1f03A6e0DA8aE6D - C2 domains: cdnjsdelivr[.]beer, update[.]constant-path[.]xyz, update-launcher[.]xyz, test-steve[.]cyou
- Exfiltration server: 193[.]221[.]200[.]219 (user-agent cpp-httplib/0.18.3)
- Mining pool: gulf[.]moneroocean[.]stream
The full report lists 22 smart contract addresses and 22 abused Polygon RPC endpoints, along with the Telegram bot tokens and chat IDs used for exfiltration.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.