Aeternum Botnet Uses Polygon Smart Contracts for Takedown-Resistant Malware C2

Aeternum is a new botnet loader designed to resist takedowns. It stores instructions on Polygon, a public blockchain, creating a widely replicated control channel that is difficult to remove.

The malware reaches Windows systems through several routes. Investigators found a packed loader, an XWorm and XMRig package, and Python code in a fake DBeaver installer.

Once launched, the samples check for virtual machines and security tools, establish startup persistence, then seek their next instructions.

Unit 42 researchers identified the campaign as an evolving operation that uses Polygon smart contracts for command and control.

Their analysis links three samples through shared code patterns and contract functions, showing how the same service can direct loaders, spyware, data theft and cryptocurrency mining without relying on a single conventional server.