Polygon Smart Contracts Enable Dynamic Malware Infrastructure Rotation

Aeternum operators have found a way to use Polygon smart contracts as a decentralized dead-drop resolver, allowing malware to retrieve and rotate command-and-control (C2) domains without relying on conventional attacker-owned servers.

This approach turns a public blockchain into resilient C2 infrastructure that is harder to disrupt through domain seizures or sinkholing. Instead of contacting a fixed hostname, an infected device submits an eth_call request containing a contract address in the to field and the function selector 0xb68d1809 in the data field.

The loader can query alternate RPC providers and retrieve updated infrastructure from the same on-chain source, making it difficult for defenders to disrupt the malware's communication. In one analyzed case, the loader communicated with 22 different contract addresses, underscoring how operators can distribute and refresh their control infrastructure.

Researchers linked activity to a smart-contract architecture that stores an administrator wallet address and encrypted domain data in separate storage slots. The contracts also retain an additional selector, 0xf851a440, while maintaining the same state-management model across deployments.