The Aeternum botnet presents a formidable challenge to cybersecurity experts by utilizing Polygon’s blockchain technology to create a robust command and control (C2) framework. This decentralized approach makes it difficult for authorities to dismantle the botnet, as its control instructions are distributed across a public blockchain network.
Entry Points and Infection Mechanisms
Aeternum infiltrates Windows systems through multiple avenues, including fake software installers like DBeaver. Within these packages, investigators uncovered a loader, XWorm, XMRig, and Python scripts. Upon activation, the malware assesses the environment for security tools and virtual machines, ensuring its persistence before fetching subsequent commands.
According to Unit 42 researchers, Aeternum’s operation is evolving, leveraging Polygon smart contracts for its C2 functions. This method not only supports malware delivery but also facilitates data theft, cryptocurrency mining, and further malicious activities without relying on traditional server infrastructure.
Blockchain and Security Implications
Aeternum’s use of blockchain technology as a control mechanism poses significant challenges for cybersecurity professionals. Unlike conventional methods where a single server can be targeted to disrupt operations, the blockchain-based approach requires identifying and neutralizing each infected device. This is complicated by the fact that the C2 instructions remain accessible on the blockchain, potentially spreading the threat further.
Communication between the botnet and its control nodes is facilitated through Polygon’s remote procedure call services. This interaction involves retrieving encrypted commands and keys, allowing operators to dynamically update C2 destinations and redirect infections without rebuilding the botnet infrastructure.
Impact and Future Outlook
The implications of Aeternum’s strategy are significant, with over 29,000 detections recorded by June 2026, demonstrating the practicality of blockchain-backed malware operations. Security teams are advised to monitor unusual Polygon JSON-RPC traffic and correlate it with system changes and suspicious API activities.
As blockchain-based botnets like Aeternum become more prevalent, defenders must adapt by restricting unapproved executables and scrutinizing telemetry data for signs of contract queries that precede malicious activities. Continuous vigilance and innovative defense strategies will be crucial in combating these sophisticated threats.
In conclusion, the Aeternum botnet exemplifies the growing trend of leveraging blockchain technology in cybercrime, presenting unique challenges that require a coordinated and informed response from the cybersecurity community.
