THE alert details an active exploit associated with the Aeternum botnet, which operates its command-and-control (C2) through Polygon smart contracts, focusing on Windows systems particularly targeting cryptocurrency users. The malware delivery involves trojanized software such as a fake DBeaver installer, employing social engineering tactics. It checks system parameters to evade detection by sandbox environments.
The botnet has displayed capabilities including credential theft, remote access functionality via the XWorm RAT, and cryptocurrency mining through the XMRig miner. Exfiltration methods include communication with Telegram bots and sending JSON-RPC requests to blockchain endpoints. Security researchers recommend monitoring for unusual RPC traffic and implementing robust endpoint protections to counter this evolving threat.