Cybersecurity researchers have identified a new botnet loader named Aeternum, which employs the Polygon blockchain to establish a command-and-control (C2) infrastructure resistant to traditional takedown methods. By embedding its instructions within smart contracts on the Polygon network, Aeternum creates a decentralized control mechanism that is challenging to disrupt.
The malware infiltrates Windows systems through various vectors, including a packed loader, a package containing XWorm and XMRig, and Python code masquerading as a legitimate DBeaver installer. Once executed, Aeternum performs checks for virtual machines and security tools, ensures persistence by modifying startup configurations, and then retrieves further instructions from the blockchain.
Unit 42 researchers have linked multiple samples of Aeternum through shared code patterns and contract functions, indicating a coordinated operation. This approach allows the botnet to deliver additional malware, exfiltrate sensitive data, and mine cryptocurrency without relying on conventional servers, thereby enhancing its resilience against takedown efforts.
By June 4, 2026, over 29,000 detection events related to Aeternum had been recorded, underscoring the practicality of blockchain-backed C2 channels for cybercriminal activities. The botnet utilizes smart contracts on the Polygon network as public noticeboards for infected devices, making it difficult for defenders to sever the control link by targeting a single hosting provider or domain registrar.
Each compromised machine queries Polygon’s remote procedure call (RPC) services to read contract values containing commands or destinations for subsequent stages. This design ensures that blocking a web host or domain does not eliminate the on-chain instructions. The loader employs a domain-retrieval function to obtain an XOR key and an encrypted C2 domain, with operators capable of updating the stored destination through administrative functions, thereby redirecting existing infections.
One analyzed loader variant unpacks itself, copies files into the AppData directory, creates a Windows Startup shortcut, and then contacts the Polygon network. It subsequently fetches both benign and malicious files from code repositories. The malware collects system information and prepares it for transfer via Telegram, demonstrating how a public blockchain lookup can facilitate connections to ordinary web services used for payload delivery and data exfiltration.
Another sample utilizes the same on-chain lookup to retrieve a Pastebin location containing XMRig configuration. It deploys the XWorm remote-access tool and a cryptocurrency miner, with later stages sending encrypted victim data to an external address. This behavior aligns with recent XWorm malware activity, which also emphasizes credential theft and session hijacking.
The Python source code suggests a targeted operation, as it impersonates a DBeaver installer, avoids lightweight analysis environments, establishes persistence, and injects code into a signed Windows binary before security monitoring initializes. Additionally, it includes routines aimed at extracting credentials from over 55 cryptocurrency browser extensions and 10 desktop wallets.
The emergence of Aeternum highlights a significant shift in botnet design, leveraging blockchain technology to create resilient and decentralized C2 infrastructures. This development poses new challenges for cybersecurity professionals, as traditional methods of disrupting botnets by targeting centralized servers or domains become less effective. Organizations must adapt by enhancing endpoint detection, monitoring for unusual blockchain-related network traffic, and implementing robust security measures to mitigate the risks associated with such advanced threats.
