Full Report
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42.
Analysis Summary
# Morning News Roll-up 2024-05-22
## Overview
Today's intelligence focus is on the emergence of decentralized command-and-control (C2) infrastructures, specifically the Aeternum botnet loader which utilizes the Polygon blockchain to evade traditional takedown methods and ensure persistent communication with infected hosts.
## Top Stories
### Aeternum Botnet’s Blockchain-Based C2 Operations
- Summary: Unit 42 has identified a new loader named Aeternum that leverages the Polygon blockchain for its C2 infrastructure. By using smart contracts, the malware achieves a high level of resilience, as the infrastructure cannot be easily "taken down" by law enforcement or hosting providers. The loader retrieves payload locations and configuration data directly from the blockchain.
- Source: hxxps://unit42[.]paloaltonetworks[.]com/aeternum-blockchain-c2-analysis/
---
# Aeternum Botnet Loader: Decentralized C2 via Polygon Blockchain
## Key Points
- **Blockchain Resilience:** Aeternum utilizes the Polygon (MATIC) blockchain to store and retrieve C2 configuration data, making the infrastructure virtually immune to traditional domain seizures.
- **Smart Contract Execution:** The malware interacts with specific smart contract functions to obtain encrypted strings that resolve to secondary payload URLs.
- **Multistage Infection:** The loader follows a modular approach, starting with a lightweight initial stub that verifies the environment before pulling down heavier post-exploitation tools.
- **Anti-Analysis:** Employs several layers of obfuscation, including API hashing and environment checks to detect sandboxes or virtual machines.
## Threat Actors
- **Aeternum Developers:** Currently unidentified group or individual selling the loader as a service (MaaS) on underground forums.
- **Motivations:** Primarily financial; the loader is designed to facilitate the deployment of infostealers, ransomware, and miners.
## TTPs
- **Command and Control (T1071.001):** Uses the Polygon RPC (Remote Procedure Call) nodes to query smart contracts.
- **Obfuscated Files or Information (T1027):** Encrypts configuration data within the blockchain to prevent simple string extraction.
- **System Binary Proxy Execution (T1218):** Often leverages legitimate system processes to execute the final stage payloads.
- **Virtualization/Sandbox Evasion (T1497):** Checks for specific hardware identifiers and driver names associated with analysis environments.
## Affected Systems
- **Operating Systems:** Windows (Multiple versions).
- **Infrastructure:** Corporate networks allowing outbound traffic to public blockchain RPC nodes (e.g., polygon-rpc[.]com).
- **Scope:** Global; targeting any industry where data theft or unauthorized resource usage is profitable.
## Mitigations
- **Network Filtering:** Monitor and potentially restrict traffic to known public blockchain RPC endpoints if not required for business operations.
- **Endpoint Detection:** Implement EDR solutions to monitor for unauthorized calls to common blockchain APIs and suspicious process injections.
- **IOC Blocking:** Block the specific smart contract addresses and associated defanged URLs listed below.
- **Behavioral Analysis:** Look for unusual PowerShell or CMD activity initiating network connections to decentralized infrastructure.
## IoCs
- **Smart Contract Address:** `0x71798363B346F604533B106900f6412140D1D3E7` (Polygon Network)
- **Defanged C2/Payload URLs:**
- hxxps://polygon-rpc[.]com
- hxxps://aeternum-project[.]com/api/updates
- hxxp://193[.]233[.]202[.]64/payload[.]exe
- **SHA256 Hashes:**
- `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` (Initial Loader)
- `7f8d9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f` (Secondary Stage)
## Conclusion
The shift toward blockchain-based C2 infrastructure represents a significant evolution in malware persistence. Aeternum demonstrates that threat actors are successfully moving away from fragile DNS-based C2 toward decentralized methods that are harder to disrupt. Organizations should ensure their security stack can inspect encrypted traffic and identify non-standard uses of blockchain protocols within their environment.