RESEARCHERS have uncovered a new botnet called Aeternum that runs its command-and-control infrastructure through smart contracts on the Polygon blockchain, primarily infecting Windows machines via trojanised software according to Unit 42. The campaign leverages social engineering to trick users into executing a fake DBeaver installer that delivers the payload.
The analysis from SecurityOnline notes that the malware is a C++ loader that creates persistence and queries Polygon smart contracts for encrypted commands as reported. Once the contract is consulted, the loader retrieves an encrypted payload, decrypts it in memory and executes it without touching disk.
After execution the botnet deploys XWorm to give attackers interactive remote access while simultaneously dropping XMRig to mine Monero. It also harvests saved credentials from web browsers and cryptocurrency wallets, sending the data to attacker-controlled servers. To avoid detection the malware checks the number of CPU cores, total RAM and looks for signs of a sandbox before proceeding with its malicious routines.
Telemetry shows the activity first appeared on 10 August 2026 and continued to be observed through 18 August 2026. Because the C2 logic resides on-chain, there is no central server that law enforcement can seize, which gives the botnet a degree of resilience to takedowns. At present no specific threat actor group has been linked to the campaign.
Defenders should monitor outbound RPC traffic to Polygon nodes for abnormal contract read or write patterns that could signal command retrieval. Connections to known Telegram bot API endpoints also merit scrutiny as they are used for exfiltration. Enabling detailed process-creation logging helps spot the loader's memory-only execution.
Application-control policies should be configured to block unsigned installers such as the fraudulent DBeaver package that initiated infection. Keeping endpoint protection signatures current with the known loader and payload hashes improves detection rates. Finally, limiting outbound HTTPS to only trusted domains and educating users about software sources reduces the risk of initial compromise.