Aeternum Botnet Leverages Polygon Blockchain for Resilient C2 Operations
What Happened — Researchers at Palo Alto Networks Unit 42 uncovered a new C++‑based botnet loader, Aeternum, that uses the public Polygon blockchain as its sole command‑and‑control (C2) channel. Infected Windows hosts query public RPC endpoints, retrieve encrypted instructions stored in smart contracts, and execute them without ever contacting traditional domains or IPs.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how attackers can bypass conventional DNS/URL filtering controls, highlighting the need for continuous network‑traffic monitoring and evidence collection of anomalous blockchain RPC calls.
- Aligns with SOC 2 CC6.1 (System Operations) and CC7.1 (Incident Management) – you must be able to detect, log, and respond to novel C2 patterns as part of a defensible audit trail.
- Directly ties to Verisq’s Control Mapping capability, which helps map emerging threats to existing SOC 2 controls and continuously collect evidence for auditors.
Who Is Affected – Any organization that runs Windows workloads and relies on standard perimeter defenses (e.g., finance, technology SaaS, cloud‑infra, manufacturing).
Recommended Actions
- Extend network‑traffic logging to include outbound RPC calls to public blockchain nodes.
- Enrich SIEM/XDR rules to flag smart‑contract‑related payloads or unusual JSON/RPC traffic.
- Update incident‑response playbooks to cover blockchain‑based C2 detection and containment.
- Map these new detection requirements to SOC 2 CC6.1/CC7.1 controls using a control‑mapping framework.
Source: Palo Alto Unit 42 – Aeternum Blockchain C2 Analysis
Technical Notes
- Malware is a UPX‑packed 32‑bit PE written in C++.
- Uses public Polygon RPC endpoints (e.g.,
https://polygon-rpc.com) to pull encrypted JSON commands from smart contracts. - Employs VM‑detection and anti‑AV tricks to evade sandbox analysis.
Source: same as above