Do Son 
Aeternum C2 and downloader network traffic activity | Image: Unit 42
At a glance
| Malware family | Aeternum (blockchain-based C2 botnet loader) |
| Threat actor | Unconfirmed; blockchain activity links to an operator using the moniker “LenAI” (suspected, not confirmed) |
| Target/victims | No confirmed sector; broad targeting of Windows systems, with an apparent focus on cryptocurrency wallet holders |
| Delivery vector | Trojanized software installers, including a fake DBeaver installer, spread through social engineering |
| Key capabilities | Blockchain-based C2 via Polygon smart contracts, sandbox evasion, credential and wallet theft, XWorm RAT and XMRig miner deployment, Telegram-based exfiltration |
| Source | Palo Alto Networks Unit 42, building on earlier host-based research from the Ctrl-Alt-Intel team |
TL;DR: Researchers at Palo Alto Networks Unit 42 identified an Aeternum blockchain botnet that runs its command-and-control entirely through Polygon smart contracts. Infected Windows machines poll the public blockchain for encrypted instructions instead of contacting a traditional server. Palo Alto Networks recorded more than 29,000 detection events tied to this activity through June 4, 2026.
Delivery
Unit 42 traced one Aeternum sample to a fake DBeaver installer. The malware uses this trojanized installer as a social engineering lure. Before running its main payload, the code checks for known sandbox usernames, computer names, and at least 8 GB of RAM. It also checks Downloads folders for Zone.Identifier data streams, a sign the system is a normal, actively used machine rather than an empty test environment. Samples that pass these checks proceed to install.
Infection Chain
Once a sample decides to run, it sets up persistence through a disguised shortcut in the Windows Startup folder. One loader variant unpacks itself in multiple stages and drops supporting binaries into the user’s AppData folder. A related sample goes further, using an Early Bird APC injection technique. It spawns a signed, suspended process and injects shellcode before security tools can fully initialize. From there, samples reach out to the Polygon blockchain for further instructions, then download additional files from GitHub or Pastebin. Depending on the sample, this leads to a Telegram-based information stealer, an XWorm remote access trojan, or an XMRig cryptocurrency miner.
Unit 42 analyzed three related samples this way: an initial loader, a blended sample that drops both XWorm and XMRig, and a separate Python-based version of the malware. That Python-based sample also targets cryptocurrency users directly, with routines built to harvest credentials from more than 55 browser extensions and 10 desktop wallets.
Command-and-Control and Data Exfiltration
This Aeternum blockchain botnet does not rely on a fixed C2 domain. Instead, infected hosts send JSON-RPC requests to public Polygon RPC endpoints and query a smart contract function. That function returns an encrypted or XOR-obfuscated C2 command, which the malware decrypts locally. Techniques vary by sample and include PBKDF2HMAC with AES-GCM, and a separate ChaCha20 and AES-based scheme.
Unit 42 noted that one sample’s password-derivation method reuses the password as its own salt, a design NIST’s SP 800-132 guidance flags as a critical flaw. All three samples call the same four-byte smart contract function selector to request commands, a pattern Unit 42 used to link the samples together despite different deployment addresses and compiler versions.
Exfiltration happens over several channels. Some samples send stolen system details straight to a Telegram bot using hard-coded credentials embedded in the binary. Others route information through an encrypted HTTPS channel to a separate server. Researchers wrote that “this establishes Aeternum as an evolving threat infrastructure,” pointing to repeated code refinements across samples.
Defense and Detection Guidance
Security teams should watch outbound traffic to public blockchain RPC endpoints from hosts with no legitimate reason to use them. Repeated JSON-RPC calls to Polygon nodes from a Windows workstation are a strong warning sign. Monitoring unexpected connections to Telegram’s API from business applications can also catch this activity early. Because samples check for common sandbox usernames and low memory, testing detection tools against production-like configurations improves detection odds.
Endpoint protection that flags Early Bird APC injection and unsigned code running inside a trusted process also helps. Because the malware reuses the same function selector across samples, tracking that selector alongside RPC traffic patterns can help identify new variants as they appear. No source has confirmed a specific target industry, so defenders across sectors should treat this Aeternum blockchain botnet as a general Windows threat.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
