Researchers Uncover Aeternum C2 Infrastructure with Advanced Persistence and Network Evasion Features

Recent research has identified a new botnet loader, Aeternum C2, that employs a novel approach by utilizing the Polygon blockchain to store its command-and-control (C2) instructions. This development poses significant challenges for traditional botnet dismantling strategies, which typically involve server or domain seizure.

The Aeternum C2 loader stores commands in smart contracts on the Polygon network, a decentralized public blockchain replicated across numerous nodes globally. This infrastructure choice renders the botnet resistant to traditional takedown methods, as there is no centralized server or domain to target.

Each command issued to infected machines is logged as a transaction on the blockchain, with bots retrieving commands via public remote procedure call (RPC) endpoints. The system supports rapid updates, with all active bots receiving new commands within two to three minutes, surpassing the efficiency of conventional peer-to-peer botnets.

The operational overhead for running an Aeternum-based botnet is minimal. The cost of executing 100 to 150 commands is approximately $1 in MATIC, the native token of the Polygon network. This low-cost model makes it more accessible to a broader range of threat actors.

The botnet is marketed on underground forums with options for a lifetime license or full C++ source code, including ongoing updates. Its capabilities extend to large-scale DDoS attacks, credential stuffing, click fraud, proxy misuse, and data theft. Even after infected machines are cleaned, the smart contracts remain intact, allowing for rapid redeployment without rebuilding the infrastructure.

The Aeternum C2 includes a web-based control panel for managing operations. It allows for various command types, such as targeting all bots, pinging specific machines, or deploying payloads. The operator can manage multiple smart contracts simultaneously, each dedicated to different functions like clippers, stealers, remote access tools (RATs), or miners.

To evade detection, Aeternum incorporates anti-VM techniques to prevent execution in virtualized environments commonly used by antivirus solutions. It also features a scantime scanner powered by the Kleenscan API, which shows a low detection rate by antivirus engines during testing.

Traditional methods like domain seizures and server takedowns are ineffective against blockchain-based C2 channels. Security teams should prioritize endpoint detection, behavioral monitoring, and application controls to identify and mitigate threats. Evaluating the possibility of monitoring or restricting outbound connections to known Polygon RPC endpoints without disrupting legitimate operations is advised. Proactive traffic filtering at the network edge is recommended as a reliable defense strategy.

Based on reporting by Cyber Security News.