Aeternum Botnet Uses Polygon Smart Contracts for Takedown-Resistant Malware C2

A new botnet loader called Aeternum has emerged, designed to resist takedowns by using Polygon smart contracts for command and control. Researchers at Unit 42 identified the campaign as an evolving operation that uses these contracts to direct loaders, spyware, data theft, and cryptocurrency mining without relying on a single conventional server.

The malware reaches Windows systems through several routes, including packed loaders, XWorm and XMRig packages, and Python code in fake DBeaver installers. Once launched, the samples check for virtual machines and security tools, establish startup persistence, and seek their next instructions from Polygon smart contracts.

Unit 42 researchers noted that the impact is broader than one malicious file, as Aeternum can deliver further malware, collect host and wallet data, and send it through Telegram or another control server. During the study, researchers recorded over 29,000 detection events by June 4, 2026, indicating that blockchain-backed control is a practical criminal tool.

The design of Aeternum resembles the blockchain resolver technique discussed in SharkStealer command infrastructure analysis, but it applies this approach across several malware components. One analyzed loader unpacked itself, copied files into AppData, and created a Windows Startup shortcut before contacting Polygon to fetch instructions.