Aeternum turns public blockchain into malware infrastructure
Unit 42 has detailed Aeternum, a C++ botnet loader that uses Polygon smart contracts as a command-and-control channel rather than relying only on conventional servers or domains. The research links the loader to related malware that uses Telegram API communications, a remote access trojan, an XMRig cryptocurrency miner and data exfiltration tooling. The finding is notable because public blockchain infrastructure can make takedown efforts harder while still leaving network and host signals defenders can monitor.A decentralized C2 model changes the takedown problem
Aeternum is significant because Unit 42 says its command-and-control infrastructure is shifted onto the public Polygon blockchain. Instead of depending on a single server, domain or hosting provider, infected devices query public remote procedure call endpoints and retrieve instructions stored through smart contracts.That model gives operators a more durable communications path. Smart contracts are designed to remain available on-chain, and the report says Aeternum uses both encrypted and plaintext instructions in that environment. For defenders and investigators, the implication is direct: blocking or seizing one conventional endpoint may not be enough if the malware can recover new instructions from a public blockchain service.
Three related samples show a broader toolchain
Unit 42 analyzed three malware cases tied to Aeternum activity: the Aeternum loader itself, a Python-based malware sample that uses Telegram API communications, and a blended case involving XWorm, XMRig and data exfiltration. The report describes Aeternum as a botnet loader that establishes persistence, performs reconnaissance and retrieves C2 instructions from Polygon.The first loader sample was a Windows executable compiled in C++ and packed before execution. Unit 42 says it copied itself into a local user directory, created a startup shortcut and then used blockchain queries to obtain further instructions. The sample also downloaded files from public code-hosting infrastructure, including a legitimate PuTTY installer and a malicious DLL, showing how ordinary services can be folded into a malware chain.
A second sample used Aeternum infrastructure to launch multiple payloads. According to the report, it dropped an XWorm client, an XMRig cryptocurrency miner and a component used for encrypted data exfiltration. That combination matters because it joins remote access, resource theft and information theft in one infection path rather than treating them as separate incidents.
Telegram and public platforms widen the abuse surface
Unit 42 also found Aeternum-linked components using Telegram API communications after the malicious DLL executed. The report says collected host information was packaged and sent through Telegram, while another Python sample used Telegram for reconnaissance alongside a separate obfuscated C2 loop.The researchers also observed public code-hosting and paste services in the activity chain. In one case, a blockchain response led to miner configuration data hosted on a paste service. In another, download activity involved files hosted in GitHub repositories. These details do not make the platforms malicious, but they show why defenders often need to evaluate behavior and sequence, not only domain reputation.
For security teams, the practical lesson is that abuse of trusted services can blur the line between normal traffic and malware operations. A workstation that contacts a public blockchain RPC endpoint, retrieves external files, runs unexpected binaries and then communicates with a messaging API is more suspicious as a chain than any single connection might appear alone.
Crypto theft and mining are part of the risk profile
The Python source-code sample described by Unit 42 shows a particular interest in cryptocurrency-related data. The report says the code included routines to harvest credentials from more than 55 cryptocurrency browser extensions and 10 desktop wallets, while also using checks intended to avoid analysis environments and select more realistic targets.The XMRig component adds a separate financial motive. Unit 42 says the miner configuration included settings intended to reduce visibility when monitoring tools were present and to interfere with competing or defensive processes. The reporting should not be read as investment or market commentary; the cryptocurrency relevance here is operational, involving wallet data theft and unauthorized mining on compromised systems.
This matters for incident response because a single Aeternum-related compromise may require more than malware removal. Teams may need to investigate credential exposure, wallet extension data, unauthorized remote access and resource abuse. Treating the incident only as a miner infection could miss the broader data-theft path described in the research.
Defensive signals remain visible despite blockchain C2
Aeternum is built for resilience, but Unit 42’s analysis shows several defensive angles. The researchers point to repeated use of Polygon smart-contract communications, downloader behavior, Telegram API activity, startup persistence and related host artifacts across the examined cases. They also cite a recurring smart-contract function selector as a useful fingerprint tying activity together across samples.Network defenders can look for unusual JSON-RPC traffic from endpoints that have no business reason to query public blockchain infrastructure, especially when followed by external downloads or messaging API submissions. Host defenders can correlate unexpected startup entries, packed Windows executables, dropped binaries and signs of credential or system-information collection.
Unit 42 says Palo Alto Networks Advanced Threat Prevention recorded more than 29,000 detection events related to the activity as of June 4, 2026. That number is vendor telemetry, not a global infection count, but it indicates that the activity has been seen at meaningful scale within the reporting environment.
Conclusion
Aeternum illustrates how malware operators are adapting public blockchain infrastructure into command-and-control design. The technique does not make the botnet invisible, but it reduces dependence on infrastructure that defenders and law enforcement traditionally target.The most useful response is layered detection. Blockchain RPC calls, trusted-service abuse, persistence artifacts, miner execution, remote access tooling and exfiltration behavior should be assessed together. Unit 42’s report frames Aeternum not as a single loader sample, but as an evolving infrastructure pattern that defenders will need to recognize across multiple payloads and delivery chains.
Sources
Editorial Team - CoinBotLab
