Emerging ThreatsMalware & Ransomware

Aeternum Botnet Exploits Blockchain for Decentralized Command Structure

Analyst 207||Source: Unit42
Aeternum Botnet Exploits Blockchain for Decentralized Command Structure

What is at stake is plain and immediate: a botnet loader has been observed using the Polygon blockchain's smart contracts to run its command-and-control and to execute payloads, a configuration that shifts parts of malware operations onto decentralized infrastructure.

Aeternum botnet loader

Unit 42 identifies the threat as the Aeternum botnet loader. The published analysis characterizes Aeternum as a loader that leverages blockchain technology as part of its operational design. Beyond the name and role — loader — the report connects Aeternum directly to a distinctive method of communications and control.

Polygon blockchain smart contracts as an operational vector

Unit 42 states that Aeternum leverages Polygon blockchain smart contracts. That fact locates a key element of the threat on a public blockchain platform: smart contracts on Polygon are used by Aeternum as an operational surface. The report describes those smart contracts as integral to how the loader conducts its activities.

Decentralized command-and-control infrastructure

According to Unit 42, Aeternum uses the blockchain-hosted smart contracts to create decentralized command-and-control (C2) infrastructure. The characterization of the C2 as decentralized is explicit in the source: the botnet’s communications and control mechanisms are not relying on a single, centrally hosted server, but rather on contracts deployed to the Polygon blockchain.

Payload execution via blockchain-hosted mechanisms

The Unit 42 analysis further states that Aeternum uses Polygon smart contracts for payload execution. The report connects the blockchain components not only to communications and control, but also to steps in the delivery and execution chain where code or actions that further the botnet’s aims are enacted.

What this means for security teams, policymakers, and enterprises

  • Security teams: Watch for Aeternum’s use of Polygon smart contracts as an explicit transport and execution mechanism. Unit 42’s description links the loader to on-chain contracts, which means detection and response workflows may need to consider blockchain artifacts alongside traditional network and host indicators.
  • Policymakers and regulators: Unit 42’s finding that a loader is using Polygon smart contracts for decentralized C2 and payload execution highlights a convergence of public blockchain infrastructure and malicious tooling that regulators may need to examine when evaluating oversight, reporting, or coordination frameworks tied to abuse of blockchain platforms.
  • Enterprises and procurement leaders: The report’s identification of blockchain-hosted C2 and execution in the Aeternum loader signals a practical consideration for vendor security assessments and supply-chain risk reviews: public smart contracts and their lifecycle can be part of a threat actor’s operational footprint.

Unit 42’s post, titled "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications," frames a concise but consequential finding: Aeternum is a loader that uses Polygon smart contracts to provide decentralized command-and-control and to execute payloads. The linkage of a botnet loader to public smart contracts reframes a part of the defensive problem onto a platform not traditionally treated as an active actor in malware operations.

For readers who want the technical breakdown and the primary analysis, see the original Unit 42 report: https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/

BlockchainEmerging ThreatsSmart ContractsMalware OperationsAeternum BotnetBotnet LoaderDecentralized Command StructurePolygon Blockchain
Related Intelligence

Continue Reading

Network equipment room with a security appliance on a rack.

Cisco ASA and FTD Flaw Exploited in Wild, Triggers Remote DoS

A high-severity vulnerability in Cisco Secure Firewall ASA and FTD software, known as CVE-2026-20349, is being actively exploited in the wild, allowing attackers to trigger a remote denial-of-service condition with a simple crafted HTTP request. This flaw, with a CVSS score of 8.6, can cause affected devices to reload, leaving networks vulnerable to disruption.

Analyst 207
Windows 11 laptop screen with security software interface and scattered notes and USB drive on desk.

Microsoft Defender Faces ShieldBreak Exploit With SYSTEM Access

A security researcher known as Chaotic Eclipse has unleashed a powerful proof-of-concept exploit called ShieldBreak, which cleverly bypasses Microsoft's patch for the RoguePlanet vulnerability, granting SYSTEM-level access. This devastating exploit has been tested on the latest Windows 11 and Server 2025 with a 100% success rate.

Analyst 207
Network operations center with rows of servers and a laptop in the foreground.

Kimwolf Botnet Evolves to Evade Takedowns and DDoS Defenses

The Kimwolf Botnet has upgraded its tactics, now using the Ethereum Name Service to evade detection and launching sophisticated HTTP/2 floods that mimic real Chrome traffic, making it harder to distinguish from legitimate visitors. This new approach allows infected devices to blend in with normal web traffic, bypassing traditional DDoS defenses.

Analyst 207
Modern cityscape with sleek buildings and subtle tech infrastructure.

DeadLock Ransomware Leverages Blockchain to Evade Takedown

DeadLock Ransomware is taking a disturbingly clever approach to evade shutdown by leveraging the Polygon blockchain to conceal its operational addresses, making it a formidable foe for cybersecurity efforts. By cleverly using decentralized building blocks, the group has already amassed a shocking 80 victims, mostly in Europe.

Analyst 207