Medium cybersecurity update: The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42 . The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications Advanced DNS Security Advanced Threat Prevention Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex XDR Cortex XSIAM Next-Generation Firewall Unit 42 Incident Response Aeternum is a recently discovered C++ botnet loader that shifts its command-and-control (C2) infrastructure entirely to the public Polygon blockchain. Instead of relying on centralized servers or domains, threat actors operate Aeternum by writing encrypted and plaintext instructions directly using smart contracts. In this article, we analyze three malware cases linked to the Aeternum botnet: Related Python-based malware using the Telegram API for C2 A blended threat consisting of XWorm RAT, the XMRig cryptocurrency miner and data exfiltration Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team . Related Unit 42 Topics Malware , Blockchain , C2 This article builds upon research by the Ctrl-Alt-Intel team on the Aeternum C2 architecture and the loader binary . This malware advertises itself as Aeternum C2 BotNet Loader, and security researchers call it either Aeternum C2 or Aeternum loader. It is the initial UPX-packed 32-bit portable executable (PE) Windows malware file compiled in C++.
Technical Details
These values consist of the JSON object strings used for HTTP-based C2 communication during the execution of the malware and its subsequent interaction with the Polygon blockchain. The full table of deobfuscated strings can be found in the Indicators of Compromise section of this article. The malware download requested two different files, putty.exe and DotNetZip.dll , as Figure 5 below shows. While investigating the malware’s downloader activity, we found requests for file artifacts hosted on GitHub in two different Github projects. Attackers could easily swap files in these repositories for malware using the same filename, instantly compromising the safety of anyone who downloads them. After successfully downloading DotNetZip.dll from GitHub and executing it, the malware sample initiated new communications to an endpoint at Telegram’s API ( api.telegram[.]org ). As a DLL, the malware's entry point DllMain() first checks for a specific condition by comparing fwReason to 1 to confirm it is being called. This function is in charge of all the information gathering and data exfiltration from the compromised machine. Once the malware has collected all the information, it constructs an HTTP request to exfiltrate the information.
Security Impact
Organizations using the affected technology should treat the report according to its medium severity classification. Thus, the malware has less work to do in terms of parsing or processing the retrieved information. After the malware retrieved data from the Pastebin URL, it started two binaries it had dropped to the infected host, one for an Xworm client and one for an XMRig cryptocurrency miner . The result is written out without any IV, chaining or authentication, closely matching a typical minimal malware-style encryption wrapper. Our third sample is a Python script file containing the source code for the Aeternum malware. By executing a read-only eth_call to a specific Polygon smart contract, the malware can retrieve and decrypt new C2 domains on the fly. Analysis of the malware’s source code reveals a multi-staged infection chain that begins with a social engineering lure impersonating a DBeaver installer. Once validated, the malware establishes persistence by creating a disguised shortcut in the Windows Startup folder and employs an Early Bird APC injection technique.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Medium
- Original source: Palo Alto Unit 42
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from Palo Alto Unit 42 for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
