Researchers Detail How Threat Actors Use Public Blockchains for Resilient Malware Command and Control
Summary
Chainalysis details how threat actors use public blockchains to store malware instructions and rotate command-and-control infrastructure, including techniques linked to DPRK, Iran-nexus, and Russian-language groups.
Key points
- Blockchain dead drops store malware payloads or command-and-control pointers in transaction data or smart contracts, allowing infected devices to retrieve instructions.
- A DPRK-linked campaign uses TRON and Aptos as redundant routes to payload instructions stored on BSC, supporting credential theft and data exfiltration.
- An Iran-nexus operation embeds encoded command-and-control routing data in Bitcoin transactions; attribution is based on malware and operational evidence, not blockchain activity alone.
- Russian-language cybercriminals use Polygon smart contracts as command-and-control resolvers, with activity consistent with a malware-as-a-service model.
- Chainalysis reports blockchain dead drops increased 420% over 12 months and 440% since the rise of high-capacity open-source AI coding tools.
- The article says blocking blockchain traffic broadly is impractical; it recommends blockchain intelligence and monitoring outbound JSON-RPC calls for defensive visibility.
Article Details
- Attack Vectors
- Malware retrieves payloads, command-and-control configurations, or infrastructure pointers from public blockchain transactions or smart contracts.
- In a DPRK-linked campaign, malware uses TRON and Aptos transaction data as redundant routes to retrieve instructions stored on BSC.
- Some attackers encode C2 IP addresses in phantom wallet address bytes and send zero-value transactions to those addresses.
- Blockchain-retrieved data directs infected devices to off-chain C2 infrastructure for remote access, credential theft, payload delivery, or data exfiltration.
- Defensive Notes
- The article says blocking blockchain traffic is not feasible as a general defense because it would disrupt legitimate applications and attackers could use their own nodes.
- Use blockchain intelligence and infrastructure-identification tools to analyze transactions, operator wallets, resolver contracts, funding chains, and update histories.
- For organizations with endpoint visibility, monitor outbound JSON-RPC calls to public blockchain endpoints as an early-warning signal.
MITRE ATT&CK
Threat Actors
Malware
Gluptebainto the amount of Satoshis being transferred. Also that year, operators of the crypto mining botnet Glupteba wrote malicious info into Bitcoin’s OP_RETURN field.Necursin limited form on the Bitcoin blockchain. The earliest example dates to 2013, when a variant of the Necurs botnet stored C2 domains on Namecoin (a Bitcoin fork). In 2019, cybercriminals encoded command andSmargaftSupported by smart contract C2, the Smargaft DDoS attack botnet was live on BSC by late December 2023.
Countries
Iranover digital defenders. A surging number of threat actors — from money-minded cybercriminals to agents of Iran — are finding their latest advantage on the blockchain. Instead of storing their malicious code onNorth Koreaand 440% since the rise of the coding tools. Our research finds nation state actors from Iran to North Korea are leading the charge.