How Malware Uses Blockchain Dead Drops to Rotate C2 Infrastructure
Summary
A practitioner guide explains how eight malware families across EVM, Solana, and TON use blockchain dead drops to retrieve C2 pointers, and how defenders can investigate RPC calls and identify suspicious process activity.
Key points
- Malware retrieves changeable C2 pointers from public blockchain infrastructure, making takedowns harder and letting operators redirect deployed loaders without changing the malware.
- EVM malware uses read-only eth_call requests; Solana variants can retrieve payloads from transaction memos, while TON loaders can query smart contracts for domains.
- Examples include DeadLock ransomware, GlassWorm, and the ChainDrop npm compromise, which affected more than 440 packages in August 2026.
- ChainDrop's dropped bun binary queried Ethereum RPC providers; the article says the contract's stored value has since been cleared.
- For investigation, examine the RPC URL, contract address, function selector, decoded result, and calling process; non-browser processes such as node, bun, or curl can help distinguish malware from benign crypto activity.
- Netskope says its IPS offers threat-hunting rules for blockchain DDR RPC patterns and provides a set of IOCs.
Article Details
- Defense Focus
- Detect and investigate malware that retrieves command-and-control pointers through blockchain dead drop resolvers, distinguishing malicious loader activity from benign crypto traffic.
- Detection Methods
- Correlate the RPC URL, contract address, function selector, and decoded response for suspicious blockchain RPC calls.
- Decode the contract response to identify a C2 URL, IP address, domain, JavaScript, or bash command; treat a 0x response as potentially stale because the value may have been rotated.
- Use process context to distinguish suspicious activity: the article identifies non-browser processes such as node, bun, or curl making these calls as evidence of malware, while browser or wallet activity may be benign.
- Use the article's one-liner pattern to query a suspicious loader's contract and retrieve its current dead-drop value.
- Data Sources
- Network traffic or Intrusion Prevention System alerts for blockchain RPC calls
- RPC URL, contract address (to field), and function selector (first four bytes of data)
- Decoded RPC result
- Calling-process context
- Rule Types
- Netskope One Threat Protection Intrusion Prevention System Threat Hunting rules for blockchain DDR RPC patterns; specific rule format is not stated.
- Platforms
- Netskope One Threat Protection Intrusion Prevention System
- Defensive Actions
- Extract the RPC URL, contract address, function selector, and decoded result from a relevant alert.
- Check whether a non-browser process made the call and decoded a C2 pointer.
- Block the live C2 value recovered from the decoded response and pivot on it.
- Re-query suspicious contracts when the response is 0x, since operators may have rotated or cleared the stored value.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | njzlopghznkamkl[.]cfd | Refreshed C2 domain returned by the TONResolver dead-drop example. |
| URL | hxxp[:]//137[.]184[.]198[.]91/R2dIXAJpSXwxP | C2 URL returned by the GlassWorm Solana memo dead-drop example. |
| URL | hxxp[:]//83[.]97[.]20[.]150 | Plaintext C2 URL returned by the TroyDen Polygon dead-drop example. |
Malware
ChainDropfamilies across three chains (EVM, Solana, TON) using the same core trick: including the August 2026 ChainDrop (“mini Shai-Hulud”) npm supply-chain compromise that uses an Ethereum eth_call dead drop.CLEARSHORTCLEARSHORT and JADESNOW both read obfuscated JavaScript or bash stagers from BNB Smart Chain contracts.DeadLockDeadLock ransomware reads a rotating Session-messenger relay URL from a Polygon contract.GlassWormThis is the GlassWorm one-liner:JADESNOWCLEARSHORT and JADESNOW both read obfuscated JavaScript or bash stagers from BNB Smart Chain contracts.SalatStealerSalatStealer and TONResolver both use TON smart contracts via get_domain.TONResolverSalatStealer and TONResolver both use TON smart contracts via get_domain.TroyDenTroyDen reads a plaintext IP from a Polygon contract, as we documented in a research blog post.