Aeternum Botnet Uses Polygon Smart Contracts for Resilient Command and Control
Summary
Unit 42 analyzes Aeternum’s Polygon-based C2 and related malware deploying XWorm, XMRig and credential theft capabilities. Researchers detail on-chain command retrieval, weak encryption and blockchain infrastructure links.
Key points
- The C++ loader queries public Polygon RPC endpoints using getDomain() selector 0xb68d1809 to retrieve encrypted or plaintext commands from smart contracts.
- Researchers decrypted loader commands using the contract address and returned payload, exploiting a weak PBKDF2HMAC/AES-GCM implementation.
- One loader sample establishes Startup-folder persistence and downloads a malicious DotNetZip.dll from GitHub; the DLL sends collected system information through Telegram using hard-coded bot credentials.
- A related sample deploys XWorm v7.4 and XMRig, obtains mining configuration from Pastebin and exfiltrates encrypted host data with an AES key included in the outgoing JSON.
- Analyzed Python source uses a DBeaver installer lure, sandbox checks, Early Bird APC injection into dpapimig.exe and routines targeting over 55 cryptocurrency browser extensions and 10 desktop wallets.
- Shared contract architecture and function selectors support the researchers’ assessment of an evolving operation; admin-only updateDomain() transactions rotate C2 information without replacing the retrieval mechanism.
- Unit 42 recorded more than 29,000 detection events as of June 4, 2026; this figure is not a count of distinct infected devices.
Article Details
- Attack Vectors
- A Python infection chain uses a social engineering lure impersonating a DBeaver installer.
- The loader retrieves commands from Polygon smart contracts through public JSON-RPC endpoints, supporting encrypted instructions and dynamically updated C2 destinations.
- The loader downloads and executes a malicious DLL from GitHub-hosted infrastructure.
- The Python sample injects shellcode into a suspended dpapimig.exe process using Early Bird APC injection.
- A related bundled sample deploys XWorm, an XMRig miner and an information-exfiltration component.
- Defensive Notes
- The researchers identify the shared getDomain() function selector 0xb68d1809 as a useful fingerprint for tracking the analyzed blockchain communications.
- The loader's on-chain encrypted commands can be decrypted using the contract address and payload because its key derivation uses a self-salting password.
- Startup-folder shortcuts provide host-based evidence of persistence in the loader and Python sample.
- Public Polygon RPC services and Telegram are legitimate infrastructure; their use alone does not establish malicious activity.
- The researchers observed similarities to ZingoStealer but explicitly could not fully attribute the exfiltration activity to that malware.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | download[.]sftp-api-group-wechat[.]com | Staging domain for components of the Python malware. |
| DOMAIN | test-steve[.]cyou | Python malware C2 domain retrieved from a Polygon smart contract. |
| DOMAIN | update-launcher[.]xyz | Python malware C2 domain retrieved from a Polygon smart contract. |
| DOMAIN | update[.]constant-path[.]xyz | Python malware C2 domain retrieved from a Polygon smart contract. |
| IPV4 | 193[.]221[.]200[.]219 | HTTP C2 server receiving encrypted host data from sample two. |
| SHA256 | 1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505 | Hash reported for the malicious DotNetZip.dll downloaded by the loader. |
| SHA256 | 4e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f | Hash reported for the dropped XWormClient.exe executable. |
| SHA256 | 5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898 | Hash reported for Build.exe, the analyzed Aeternum C++ loader. |
| SHA256 | 81bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9f | Hash reported for miner.exe, the XMRig miner deployed by sample two. |
| SHA256 | ea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2 | Hash of the Python malware source sample containing blockchain fallback C2 and credential-harvesting routines. |
| SHA256 | f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27 | Hash reported for XBinderOutput_protected.exe, which drops XWorm, XMRig and an exfiltration component. |
| URL | hxxp[:]//sekirolegion[.]duckdns[.]org/api/endpoint.php | Malware C2 callback endpoint linked to the exfiltration IP. |
| URL | hxxps[:]//cdnjsdelivr[.]beer/ | New C2 destination that the article reports LenAI pushed through an updateDomain smart-contract transaction. |
MITRE ATT&CK
T1001.001 · Junk DataThe Python sample pads obfuscated JSON C2 payloads with junk data to disrupt traffic signatures.T1027 · Obfuscated Files or InformationSamples conceal configuration, commands and embedded payloads using XOR and layered encryption.T1036 · MasqueradingThe Python malware uses the disguised binary name WmiPrvSE.exe and a DBeaver installer lure.T1055.004 · Asynchronous Procedure CallThe Python sample uses Early Bird APC injection to execute shellcode in suspended dpapimig.exe.T1057 · Process DiscoveryThe miner identifies monitoring utilities and endpoint security processes for suspension or termination decisions.T1071.001 · Web ProtocolsSamples exchange C2 instructions through HTTP JSON-RPC requests and send HTTP POST requests to an exfiltration server.T1082 · System Information DiscoveryDotNetZip.dll gathers CPU, RAM, disk and GPU information before sending it through Telegram.T1102 · Web ServiceThe malware uses Polygon smart contracts for command retrieval and Telegram bots for C2 and exfiltration.T1105 · Ingress Tool TransferThe loader downloads additional files, including malicious DotNetZip.dll, from GitHub.T1140 · Deobfuscate/Decode Files or InformationThe loader decrypts on-chain instructions using PBKDF2HMAC/AES-GCM; the bundled sample decrypts embedded payloads with ChaCha20 and AES.T1496 · Resource HijackingThe bundled sample deploys XMRig to mine Monero using compromised-host CPU resources.T1497.001 · System ChecksSamples check virtual environments; the Python source checks sandbox usernames, machine names, RAM and Downloads-folder Zone.Identifier streams.T1547.001 · Registry Run Keys / Startup FolderThe loader and Python sample create Windows Startup-folder shortcuts for persistence.T1555 · Credentials from Password StoresThe Python source contains credential-harvesting routines targeting more than 55 cryptocurrency browser extensions and 10 desktop wallets.T1562.001 · Disable or Modify ToolsThe miner's kill-targets configuration terminates endpoint security processes to prevent remediation.
Threat Actors
Malware
AeternumAeternum is a C++ botnet loader that moves command-and-control operations onto the Polygon blockchain, using smart contracts and RPC queries to retrieve encrypted or plaintext instructions.XMRigThe investigation also links Aeternum to a Telegram-based Python malware family and a blended payload set involving XWorm RAT and the XMRig miner, while highlighting persistent infrastructure and evasion tactics.XWormThe investigation also links Aeternum to a Telegram-based Python malware family and a blended payload set involving XWorm RAT and the XMRig miner, while highlighting persistent infrastructure and evasion tactics.ZingoStealer(i.e., drop of a .sys file) and network patterns (e.g., URI path, JSON object attributes) match with ZingoStealer reported by Cisco Talos on April 13, 2022. However, we cannot fully attribute this activity to
Vendors
Products
Advanced Threat PreventionThroughout the duration of this study, our Advanced Threat Prevention security solution successfully identified and recorded more than 29,000 detection events (as of June 4, 2026).PolygonAeternum is a C++ botnet loader that moves command-and-control operations onto the Polygon blockchain, using smart contracts and RPC queries to retrieve encrypted or plaintext instructions.TelegramThe investigation also links Aeternum to a Telegram-based Python malware family and a blended payload set involving XWorm RAT and the XMRig miner, while highlighting persistent infrastructure and evasion tactics.
Tools
Burp SuiteFigure 9 shows an exfiltration request revealed using Burp Suite that contains an example of the data collected by the malware sample.capeWe extracted the Xworm sample’s configuration using CAPE’s community parser for XWorm.UPX– The samples hide strings, payloads, and commands with XOR, encryption, packing, and layered decryption (‘UPX-packed’, ‘deobfuscate global configuration data’, ‘encrypted C2 commands’).WiresharkFigure 2 shows an example of the communications traffic filtered in Wireshark.