A new Windows malware loader called Aeternum is using the Polygon blockchain to establish a command-and-control mechanism designed to withstand conventional takedown efforts, according to researchers at Unit 42. Rather than depending on a conventional server or domain that can be seized or blocked, the malware stores operational instructions in a Polygon smart contract, allowing infected systems to retrieve information from a publicly replicated blockchain network.
Researchers found that Aeternum can use Polygon smart contracts as a persistent command channel, allowing attackers to redirect infected systems without relying on a single server, hosting provider, or domain.
The campaign has been linked to several malware samples that share code characteristics and smart-contract functions. Investigators identified a packed loader, an XWorm and XMRig package, and Python-based malware disguised as a DBeaver software installer. The findings indicate that the infrastructure can support multiple malicious activities, including remote access, information theft, cryptocurrency mining, and additional malware delivery.
Unit 42 described the operation as an evolving campaign rather than a single malicious file. Researchers recorded more than 29,000 detection events by June 4, 2026, suggesting that blockchain-backed command infrastructure is being used at a meaningful scale.
Polygon smart contract acts as a public control point
Aeternum uses a smart contract as a publicly accessible source of instructions for compromised devices. Each infected system can query Polygon remote procedure call services and retrieve a contract value containing either a command or information pointing to the next stage of the attack.
This structure creates a challenge for defenders because blocking a malicious website or taking down a domain does not remove the information stored on the blockchain. Instead, security teams must identify infected systems and disrupt the malware locally.
The loader uses a domain-retrieval function to obtain an XOR key and an encrypted command-and-control domain. An administrative function allows attackers to change the stored destination, potentially redirecting existing infections without rebuilding or redeploying the entire botnet.
One analyzed loader unpacked itself, copied components into the Windows AppData directory, and created a Startup shortcut to establish persistence. After contacting Polygon, it retrieved additional files from code repositories. A related DLL gathered system information and prepared the collected data for transmission through Telegram.
Researchers also identified weaknesses in the malware’s encryption implementation. By examining the contract address and returned payload, they were able to recover encrypted instructions, including commands directing compromised machines to download additional files.
Malware combines access, theft and cryptocurrency mining
A second sample used the same blockchain-based lookup mechanism to obtain a Pastebin location containing an XMRig configuration. The malware subsequently deployed XWorm, a remote-access tool, alongside a cryptocurrency miner. At a later stage, it transmitted encrypted information about victims to an external destination.
The campaign also included Python code disguised as a legitimate DBeaver installer. The sample was designed to reject certain lightweight analysis environments, establish persistence, and inject code into a signed Windows process before security monitoring mechanisms were fully active.
The Python-based branch included capabilities targeting credentials stored by more than 55 cryptocurrency browser extensions and 10 desktop wallets, expanding the campaign beyond basic system compromise.
Telegram was used for reconnaissance and data exfiltration in this branch. Researchers also found junk-filled JSON data intended to make malicious network activity less obvious during analysis.
The combination of blockchain infrastructure and conventional online services gives operators considerable flexibility. Polygon can provide the persistent lookup mechanism, while services such as code repositories, Pastebin and Telegram can handle malware delivery and stolen-data movement.
Security teams urged to monitor blockchain traffic
The emergence of Aeternum highlights a broader challenge for defenders as attackers experiment with public blockchains for command infrastructure. Because smart-contract data is replicated across the network, conventional domain blocking and hosting-provider takedowns may have limited effectiveness.
Security teams should monitor unusual Polygon JSON-RPC activity and correlate blockchain queries with downloads, Windows Startup shortcuts, process injection, and Telegram API connections. They should also investigate processes launched from user-writable directories and examine outbound communications that occur immediately after blockchain lookups.
The ability to change destinations through smart-contract functions could allow operators to redirect existing infections without rebuilding the botnet, increasing the resilience and operational flexibility of the campaign.
Researchers expect blockchain-based botnet infrastructure to remain an area of concern as criminals seek alternatives to centralized command servers. For defenders, behavior-based detection and correlation across endpoint, network, and blockchain-related telemetry may become increasingly important in identifying such operations.
