ChainScript RAT Uses Polygon Smart Contract to Hide Its C2 Server

ChainScript RAT Uses Polygon Smart Contract to Hide Its C2 Server

What Happened — Blackpoint’s research team uncovered a new Node.js‑based remote‑access trojan, dubbed ChainScript, that retrieves its command‑and‑control (C2) endpoint from a public Polygon smart contract. The malware is delivered via a fake “Spotify” installer that runs without administrative rights and then queries the blockchain for a WebSocket address that can be rotated at will.

Why It Matters for Trust & Control Assurance

• The technique bypasses traditional network‑based blocklists because the C2 address is not hard‑coded; it is resolved dynamically from a public ledger.
• Continuous monitoring of outbound connections and logging of blockchain‑related DNS or RPC calls become essential control evidence for detecting such “EtherHiding” activity.
• Mapping this detection requirement to a single control objective (monitoring of unauthorized external communications) satisfies multiple framework clauses simultaneously, providing a defensible audit trail.

Who Is Affected – Any organization that allows user‑level software installation on corporate endpoints, especially those with limited application whitelisting or endpoint monitoring (e.g., enterprise IT, SaaS providers, managed service firms).

Recommended Actions

• Extend network‑traffic monitoring to include outbound calls to blockchain nodes and smart‑contract query endpoints.
• Enforce strict application‑allow lists that block unsigned Node.js runtimes and unknown installers.
• Capture and retain logs of RPC calls to public blockchains for at least 30 days to support forensic analysis.

Source: SecurityAffairs – ChainScript RAT

Technical Notes

• Malware delivery: social‑engineering prompt to run a msiexec.exe command that downloads a disguised installer.
• Execution chain: PowerShell → VBScript → bundled Node.js runtime (no admin rights required).
• C2 resolution: eth_call to Polygon contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 (chain ID 137) using selector 0x4ab7874e; response contains a ws:// or wss:// endpoint.
• No CVE is associated; the threat lies in the novel use of blockchain as a dynamic resolver.