--- title: "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications" url: https://daily.dev/posts/the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications-6sos54pe7 source_url: https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis type: article source: "Unit 42" published: 2026-08-10T22:03:06.319Z updated: 2026-08-10T22:03:42.954Z tags: ["malware", "blockchain"] reading_time: 22 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications **[Unit 42](https://daily.dev/sources/unit42)** · 22 min read · 0 upvotes · 0 comments ## Summary Unit 42 researchers analyze Aeternum, a C++ botnet loader that uses Polygon blockchain smart contracts as its command-and-control infrastructure instead of traditional centralized servers. The malware queries public RPC endpoints to retrieve encrypted commands stored in smart contracts via the getDomain() function selector (0xb68d1809). Three samples are examined: the core Aeternum loader using PBKDF2HMAC/AES-GCM with a self-salting flaw, a blended threat combining XWorm RAT v7.4, XMRig cryptocurrency miner, and a data exfiltrator, and Python-based malware with Early Bird APC injection targeting cryptocurrency wallets. All samples share the same blockchain function selectors, linking them to a single evolving threat actor (LenAI). The decentralized C2 architecture makes traditional law enforcement takedowns ineffective, and Palo Alto Networks recorded over 29,000 detection events during the study period. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Aeternum botnet use blockchain for C2 communications? Aeternum stores encrypted C2 commands directly in Polygon blockchain smart contracts and infected hosts query public JSON-RPC endpoints to retrieve them. The malware calls the getDomain() function (selector 0xb68d1809) on smart contract addresses to fetch commands. Decryption uses PBKDF2HMAC/AES-GCM with a self-salting flaw — the smart contract address itself serves as both password and salt — making decryption possible with just those two known values. _Defenders tracking blockchain-based C2 techniques find the latest threat intelligence on daily.dev._ ### What cryptographic weakness does Aeternum's encryption scheme have? Aeternum uses a self-salting password, which NIST classifies as a critical cryptographic flaw under SP 800-132. The PBKDF2HMAC key derivation uses the password itself as the salt, making the encryption deterministic and breakable. Because both the smart contract address (used as the password) and the encrypted payload are publicly visible on-chain, any analyst can decrypt the C2 commands using those two known values. _Security engineers auditing cryptographic implementations in malware or their own code track findings like these on daily.dev._ ### What is the XWorm version used in the Aeternum-linked blended threat sample? The Aeternum-linked blended threat drops XWorm v7.4, identifiable because the dropped client is named XWormclient.exe — the default filename produced by the XWorm v7.4 builder. The configuration, extracted via CAPE's XWorm parser, includes the C2 server, IP address, port, mutex, and encryption key. Researchers replicated the C2 connection by using those extracted values against a controlled matching panel instance. _Threat hunters investigating RAT campaigns and their tooling stay current on daily.dev._ ## Similar posts on daily.dev - [DeadLock ransomware uses blockchain to resist infrastructure takedown](https://daily.dev/posts/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-takedown-ay3u9m6e9) · BleepingComputer · 0 upvotes · 0 comments - [Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites](https://daily.dev/posts/hackers-abuse-blockchain-smart-contracts-to-spread-malware-via-infected-wordpress-sites-85eqcwd21) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#blockchain](https://daily.dev/tags/blockchain) [View this post on daily.dev](https://daily.dev/posts/the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications-6sos54pe7)