Malware Uses Blockchain Dead Drops to Retrieve Runtime C2 Pointers
Summary
A Netskope primer explains how malware retrieves runtime C2 pointers through EVM smart contracts, Solana transaction memos and TON lookups, and recommends correlating RPC details, decoded results and process context to detect the activity.
Key points
- EVM-based loaders use eth_call against Ethereum, Polygon or BNB Smart Chain contracts, decoding responses into C2 pointers or stagers that may use Base64 or other encodings.
- Solana examples retrieve recent transaction signatures, then inspect transaction memo data for encoded payloads.
- TON malware examples use get_domain lookups to retrieve C2 domains; SalatStealer and TONResolver are cited.
- The article reports that ChainDrop, also called “mini Shai-Hulud,” compromised more than 440 npm packages in August 2026 and used an Ethereum eth_call dead drop.
- TroyDen, DeadLock, CLEARSHORT and JADESNOW are cited as examples of malware using EVM contract reads for C2 or stager data.
- For detection, the post recommends correlating the RPC URL, contract address, function selector, decoded result and calling process context.
Article Details
- Attack Vectors
- EVM-based loaders use eth_call requests to public RPC nodes and decode smart-contract responses into C2 pointers, which may be URLs, IP addresses, domains, JavaScript, or bash stagers.
- GlassWorm queries Solana transaction signatures and transaction data, then extracts a Base64-encoded C2 URL from a memo instruction.
- TONResolver and SalatStealer query TON smart contracts with get_domain to retrieve C2 domains.
- ChainDrop compromised more than 440 npm packages in August 2026; its dropped bun binary retrieves a value through Ethereum eth_call and exfiltrates to the resolved domain.
- C2 pointers may be encoded as Base64, Base64 plus XOR, or gzip plus Base64.
- Defensive Notes
- Correlate the RPC URL, contract address, function selector, decoded result, and calling process when investigating a blockchain dead-drop RPC call.
- Use process context to help distinguish malware from benign activity: the article identifies non-browser processes such as node, bun, or curl as suspicious in this context, while browsers or wallets may make benign calls.
- Do not rely on RPC host reputation alone; malware may use the same public endpoints as wallets and decentralized applications.
- A contract call returning 0x may indicate that the operator has cleared or rotated the stored value.
- Netskope One Threat Protection Intrusion Prevention System (IPS) detects blockchain dead-drop RPC patterns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | njzlopghznkamkl[.]cfd | C2 domain returned by the TONResolver get_domain query. |
| URL | hxxp[:]//137[.]184[.]198[.]91/R2dIXAJpSXwxP | C2 URL extracted from a Solana transaction memo by the GlassWorm example. |
| URL | hxxp[:]//83[.]97[.]20[.]150 | Plaintext C2 URL returned by the TroyDen Polygon dead-drop call. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes C2 pointers encoded with Base64, Base64 plus XOR, or gzip plus Base64, and payloads hidden in Solana memo data.T1071.001 · Web ProtocolsLoaders use JSON-RPC or REST requests to public blockchain endpoints to retrieve dead-drop values.T1102.001 · Dead Drop ResolverMalware retrieves C2 pointers at runtime from public blockchain smart contracts or transaction data instead of hardcoding them.
Malware
ChainDropChainDrop, also called “mini Shai-Hulud,” compromised more than 440 npm packages and used an Ethereum eth_call dead drop.ChainDropIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.CLEARSHORTIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.DeadLockIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.GlassWormIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.JADESNOWIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.SalatStealerIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.TONResolverIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.TroyDenIt highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns.
Vendors
Products
BNB Smart ChainEVM-based loaders use eth_call against Ethereum, Polygon, or BNB Smart Chain to decode a contract response into an IP, URL, domain, JavaScript, or bash stager.Ethereum#ChainDropNetskope One Threat ProtectionNetskope One Threat Protection Intrusion Prevention System (IPS) detects blockchain DDR RPC patterns.npmChainDrop, also called “mini Shai-Hulud,” compromised more than 440 npm packages and used an Ethereum eth_call dead drop.Polygon#ChainDropSolanaThis article explains how malware uses blockchain dead drop resolvers to fetch command-and-control pointers at runtime from smart contracts on EVM chains, Solana, and TON instead of hardcoding them.The Open Network (TON)This article explains how malware uses blockchain dead drop resolvers to fetch command-and-control pointers at runtime from smart contracts on EVM chains, Solana, and TON instead of hardcoding them.