Blockchain C2 Archives • Daily CyberSecurity

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays

Do Son August 4, 2026

At a glance Malware family Dysphoria (jackskid/fbot-derived IoT botnet) Threat actor Unattributed; run as a commercial DDoS-for-hire...

PHANTOMPULSE malware analysis blockchain C2 channel

PHANTOMPULSE Malware Analysis: Advanced Cryptographic Implants Exploiting Blockchain Networks

Do Son June 6, 2026

Unveiling a Highly Sophisticated Process Injection Framework Security researchers recently uncovered a highly intricate software implant targeting...

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm npm Supply Chain Attack DPRK Malware Factory

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm

Do Son April 29, 2026

Cybersecurity researchers at Panther Threat Research have released a detailed exposé on a massive, coordinated npm malware...

AI-Generated RAT “PHANTOMPULSE” Targets Crypto Sector via Social Engineering PHANTOMPULSE RAT Obsidian Malware Abuse

AI-Generated RAT “PHANTOMPULSE” Targets Crypto Sector via Social Engineering

Do Son April 17, 2026

In a sophisticated intersection of social engineering and technical ingenuity, security researchers have uncovered a novel campaign...

“React2Shell” Exploited: New EtherRAT Malware Hunts for Crypto via Node.js NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

“React2Shell” Exploited: New EtherRAT Malware Hunts for Crypto via Node.js

Do Son December 23, 2025

A new, sophisticated malware campaign is sweeping across the internet, leveraging a recently disclosed vulnerability to install...

EtherRAT Malware Hijacks Ethereum Blockchain for Covert C2 After React2Shell Exploit EtherRAT C2 Blockchain, React2Shell DPRK

EtherRAT Malware Hijacks Ethereum Blockchain for Covert C2 After React2Shell Exploit

Do Son December 10, 2025

In a alarming escalation of the “React2Shell” crisis, security researchers have uncovered a sophisticated new malware strain...

Tsundere Botnet Uncovered: Node.js Malware Uses Ethereum Smart Contract for Unkillable C2 and Runs Cybercrime Marketplace Tsundere Blockchain C2, Node.js Botnet

Tsundere Botnet Uncovered: Node.js Malware Uses Ethereum Smart Contract for Unkillable C2 and Runs Cybercrime Marketplace

Do Son November 24, 2025

Kaspersky’s Global Research & Analysis Team (GReAT) has identified a fast-growing new botnet—dubbed Tsundere—that blends Node.js implants,...