Polygon Smart Contracts Used for Dynamic Malware Command-and-Control Domain Rotation

Aeternum operators have discovered a new way to rotate command-and-control (C2) domains dynamically using Polygon smart contracts. This decentralized dead-drop resolver allows malware to retrieve and update C2 domains without relying on conventional attacker-owned servers.

The approach utilizes public blockchain technology, making it harder for security teams to disrupt the C2 infrastructure through domain seizures or sinkholing. Infected devices submit an eth_call request containing a contract address and function selector 0xb68d1809, which maps to a getDomain() routine that returns an encrypted or plaintext command payload.

A key operational capability is the administrative smart-contract method identified as 0xb249cd2d, or updateDomain(). Operators with the deployer wallet can invoke it to overwrite the stored C2 value and push a replacement domain to infected hosts without rebuilding or redistributing the loader. The contracts also retain an additional selector, 0xf851a440.