Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown
27.02.2026
19602
Researchers detail Aeternum C2 storing botnet commands on Polygon blockchain, while DSLRoot operates 300 residential proxy devices across U.S.
Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown
Hold up — hackers are now using blockchain to make their botnets untouchable. Researchers just exposed Aeternum C2, a botnet that stores its encrypted commands on the Polygon blockchain. This isn't just crypto bros playing around — it's a legit evasion tactic designed to survive takedowns.
Here's the play: Instead of relying on traditional C2 servers that can get seized, Aeternum C2 writes its commands into smart contracts on Polygon. The botnet's infected devices then read those commands directly from the blockchain. Since blockchain data is decentralized and immutable, good luck trying to shut that down.
Meanwhile, another crew called DSLRoot is running a separate operation with 300 residential proxy devices scattered across the U.S. These aren't your average data center IPs — they're real home connections, making detection and blocking way harder. Think of it as a ghost network hiding in plain sight.
Both threats are live right now, and they're a stark reminder that cybercriminals are leveling up their infrastructure game. Blockchain-based C2? Residential proxy armies? This is next-gen stealth, and defenders need to catch up fast.
- • Aeternum C2 botnet uses Polygon blockchain to store encrypted commands in smart contracts
- • Blockchain-based C2 makes takedowns nearly impossible due to decentralization
- • DSLRoot operates 300 residential proxy devices across the United States
- • Residential proxies use real home IPs, evading traditional detection methods
- • Both threats are currently active and represent advanced evasion tactics
#blockchain#botnets#proxy networks#smart contracts
Got a topic? Write to ATLA WIRE on Telegram:t.me/atla_community
