State-Linked Hackers Fuel Blockchain Malware Surge with 420% Jump

State-linked hackers are increasingly using public blockchains as 'dead drops' for malware instructions and infrastructure details, according to a new Chainalysis report. The firm estimates that state-aligned actors accounted for roughly two-thirds of new dead drop activity each quarter.

The frequency of these writes rose 420% over the past 12 months. Chainalysis also reports that operators tied to North Korea and Iran are among the groups adopting the tactic, including activity it linked across multiple networks, Tron, Aptos, and BNB Smart Chain (BSC), to a North Korea-associated actor tracked by Google Threat Intelligence.

North Korea-linked groups have used multi-chain routing, with Tron acting as a first route and Aptos as a fallback to a BSC transaction containing encrypted instructions. Iran-linked operators are also suspected of using the Bitcoin blockchain to publish encoded command-and-control routing data that infected devices can poll for updates.