Aeternum Botnet Leverages Polygon Blockchain for Highly Resilient C2 Operations

Aeternum is a sophisticated botnet loader that uses the public Polygon blockchain for command-and-control (C2) operations and communications. Unlike traditional C2 infrastructure, Aeternum relies on smart contracts to execute encrypted and plaintext instructions directly. The botnet uses decentralized networks and evasion techniques, making it highly resilient and difficult to take down.

Our analysis focuses on three malware samples associated with Aeternum activity. We examined the loader's behavior, including its persistence mechanism, configuration retrieval, and network communications. The loader communicates with the Polygon blockchain using JSON-RPC requests and retrieves encrypted C2 commands from immutable smart contract addresses.

The botnet also uses a weak encryption scheme, implementing a self-salting password that can be decrypted using known variables. This implementation is in line with the US National Institute of Standards and Technology's (NIST) remediation standard, which considers self-salting passwords a critical cryptographic flaw.