Topic

Blockchain Command and Control

The use of public blockchains and smart contracts as dead drop resolvers, where malware reads current server addresses from on-chain data instead of hardcoding them.

Current clusters

security1 publisher

ChainScript RAT resolves its command channel through a Polygon smart contract

Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.

Publishers:thehackernews.com

Reality

Evidence60
Adoption45
Hype gap+10
Incentives70
Confidence55

security1 publisher

KREMLIN installers forge Chrome's Secure Preferences HMACs to register a stealer extension

Elastic Security Labs says the Brazilian crew it calls REF9334 has been running this since at least May 2025, writing its extension into Chromium's Secure Preferences and reading C2 addresses out of an Ethereum smart contract.

Publishers:thehackernews.com

Reality

Evidence62
Adoption42
Hype gap+12
Incentives55
Confidence58