Unit 42 researchers analyze Aeternum, a C++ botnet loader that uses Polygon blockchain smart contracts as its command-and-control infrastructure instead of traditional centralized servers. The malware queries public RPC endpoints to retrieve encrypted commands stored in smart contracts via the getDomain() function selector (0xb68d1809). Three samples are examined: the core Aeternum loader using PBKDF2HMAC/AES-GCM with a self-salting flaw, a blended threat combining XWorm RAT v7.4, XMRig cryptocurrency miner, and a data exfiltrator, and Python-based malware with Early Bird APC injection targeting cryptocurrency wallets. All samples share the same blockchain function selectors, linking them to a single evolving threat actor (LenAI). The decentralized C2 architecture makes traditional law enforcement takedowns ineffective, and Palo Alto Networks recorded over 29,000 detection events during the study period.
Table of contents
Executive SummaryBackground on AeternumSample One: Aeternum LoaderSample Two: XWorm + XMRig CoinMinder + Data ExfiltrationSample Three: Python Malware Source Code AnalysisConclusionIndicators of CompromiseAdditional ResourcesQuestions this post answers
How does the Aeternum botnet use blockchain for C2 communications?
Aeternum stores encrypted C2 commands directly in Polygon blockchain smart contracts and infected hosts query public JSON-RPC endpoints to retrieve them. The malware calls the getDomain() function (selector 0xb68d1809) on smart contract addresses to fetch commands. Decryption uses PBKDF2HMAC/AES-GCM with a self-salting flaw — the smart contract address itself serves as both password and salt — making decryption possible with just those two known values. Defenders tracking blockchain-based C2 techniques find the latest threat intelligence on daily.dev.
What cryptographic weakness does Aeternum's encryption scheme have?
Aeternum uses a self-salting password, which NIST classifies as a critical cryptographic flaw under SP 800-132. The PBKDF2HMAC key derivation uses the password itself as the salt, making the encryption deterministic and breakable. Because both the smart contract address (used as the password) and the encrypted payload are publicly visible on-chain, any analyst can decrypt the C2 commands using those two known values. Security engineers auditing cryptographic implementations in malware or their own code track findings like these on daily.dev.
What is the XWorm version used in the Aeternum-linked blended threat sample?
The Aeternum-linked blended threat drops XWorm v7.4, identifiable because the dropped client is named XWormclient.exe — the default filename produced by the XWorm v7.4 builder. The configuration, extracted via CAPE's XWorm parser, includes the C2 server, IP address, port, mutex, and encryption key. Researchers replicated the C2 connection by using those extracted values against a controlled matching panel instance. Threat hunters investigating RAT campaigns and their tooling stay current on daily.dev.