Listen to this Post
A New Chapter in Blockchain-Powered Cybercrime
Cybercriminal operations are becoming harder to track because attackers are no longer relying exclusively on traditional command-and-control infrastructure. Instead, they are increasingly turning legitimate technologies into covert communication channels, and the latest Aeternum activity shows how blockchain infrastructure can be transformed into a resilient malware control system.
At the same time, the Deadlock ransomware operation has struck LT Group and Fortune Tobacco in the Philippines, reportedly exposing thousands of files containing highly sensitive information. Together, these incidents demonstrate two very different sides of the modern threat landscape: one focused on hiding malware communications, the other focused on stealing and monetizing valuable corporate data.
The common thread is resilience. Attackers are building operations that are designed to survive infrastructure disruption, security monitoring, and conventional defensive controls.
Aeternum Turns Polygon Smart Contracts Into a C2 Channel
Aeternum has shifted its command-and-control infrastructure toward the Polygon blockchain, according to cybersecurity reporting cited in the supplied intelligence.
Rather than depending on a conventional domain or centralized server that defenders can identify, block, seize, or take offline, the malware can interact with blockchain smart contracts through remote procedure call, or RPC, infrastructure.
This changes the defensive equation.
A traditional C2 server can potentially be sinkholed. A malicious domain can be suspended. An IP address can be blocked. A compromised server can be confiscated.
Blockchain-based infrastructure introduces a different problem because information stored through a public blockchain can remain accessible through multiple independent nodes and RPC providers.
The getDomain() Function Becomes Part of the Attack Chain
The reported Aeternum implementation uses blockchain queries involving a getDomain() function to retrieve information associated with the malware’s command infrastructure.
The commands may be encrypted or available in plaintext, depending on the implementation.
This technique effectively turns a smart contract into a distributed rendezvous point. Instead of asking a conventional server, the malware queries blockchain infrastructure for information that helps determine where or how it should communicate.
The result is an unusual combination of decentralized infrastructure and traditional malware.
XWorm and XMRig Payloads Raise the Stakes
The infrastructure is particularly concerning because linked payloads reportedly include XWorm RAT and XMRig.
XWorm is associated with remote-access capabilities that can give attackers broad control over compromised Windows systems.
XMRig, meanwhile, is commonly associated with cryptocurrency mining. When deployed without authorization, it can consume CPU resources, increase electricity usage, degrade system performance, and generate cryptocurrency for the attacker.
This combination illustrates how a single intrusion infrastructure can support multiple criminal objectives.
One payload can provide remote access and surveillance capabilities, while another can monetize compromised computing resources.
Why Blockchain C2 Is So Difficult to Defend Against
The fundamental attraction of blockchain-based C2 is not that the technology is inherently malicious. It is that blockchain infrastructure provides properties attackers can abuse.
Publicly accessible information can be replicated across a large ecosystem.
Smart contracts can remain available without a conventional server administrator.
Transactions can be observed, but that does not automatically make the underlying malware communication easy to stop.
Attackers can also change infrastructure logic without rebuilding their entire operational model.
For defenders, this means that blocking one domain or IP address may no longer be enough.
The Deadlock Ransomware Attack on LT Group and Fortune Tobacco
While Aeternum demonstrates an emerging C2 technique, the Deadlock ransomware incident highlights a much more direct threat to corporate operations.
LT Group and Fortune Tobacco in the Philippines were hit by Deadlock ransomware, with the incident involving the exposure of a large quantity of corporate information.
The reported dataset contains approximately 14,836 files and around 27 GB of data.
The information reportedly includes passports, banking records, tax documentation, debt-related information, and other sensitive corporate material.
That combination makes the incident especially serious.
A ransomware attack is no longer simply a story about encrypted computers and interrupted operations. Modern ransomware groups increasingly combine encryption, data theft, public pressure, and reputational damage.
Seventy-Two Hours Can Become a Dangerous Turning Point
The reporting indicates that Deadlock moved toward data exposure after approximately 72 hours of silence.
That period matters because ransomware negotiations can quickly evolve from an internal crisis into a public incident.
When attackers possess sensitive documents, they do not necessarily need to encrypt every system to create pressure.
The stolen information itself becomes leverage.
Executives must then consider operational disruption, legal obligations, regulatory exposure, customer confidence, business continuity, and the possibility that private documents will eventually circulate beyond the attackers’ infrastructure.
Sensitive Documents Make the Incident More Dangerous
Passport records can expose identity information.
Banking documents can reveal financial relationships and account details.
Tax records can contain highly valuable personal and corporate information.
Debt records can reveal financial obligations and relationships that organizations would normally expect to remain confidential.
The significance of a 27 GB dataset therefore cannot be measured purely by its size.
Twenty-seven gigabytes of ordinary files may be relatively unimportant.
Twenty-seven gigabytes of financial and identity documents can become a major security and privacy crisis.
The Bigger Picture: Two Attack Models, One Direction
Aeternum and Deadlock appear to represent different operational models.
Aeternum focuses heavily on maintaining access and hiding communication.
Deadlock focuses heavily on extortion and stolen information.
Yet both reveal the same fundamental trend.
Cybercriminals are building operations around persistence.
They are planning for disruption.
They are looking for infrastructure that is difficult to dismantle.
They are also turning every available layer of technology into an opportunity.
Cloud platforms, public APIs, legitimate services, blockchain networks, remote-management tools, and compromised credentials can all become components of an attack chain.
Why Security Teams Should Pay Attention to Blockchain Queries
Security teams traditionally concentrate on domains, IP addresses, DNS activity, HTTP connections, and known malware signatures.
Blockchain-enabled C2 complicates that model.
A workstation performing an RPC request to a blockchain endpoint may not immediately look malicious.
The connection could resemble legitimate application traffic.
The suspicious element may instead be the combination of the process generating the request, the destination RPC provider, the timing, the frequency of calls, and the specific smart-contract functions being queried.
Behavioral analysis therefore becomes increasingly important.
Defenders Need to Monitor the Process, Not Just the Destination
An important lesson from Aeternum is that network reputation alone may not provide enough visibility.
Security teams should ask:
Which process is communicating with the RPC endpoint?
Why is that process querying blockchain infrastructure?
What smart-contract addresses are being accessed?
Does the application normally require blockchain connectivity?
Is the same endpoint contacted repeatedly?
Are suspicious payloads being downloaded after blockchain queries?
Does the host also show signs of credential theft, persistence, remote access, or unauthorized cryptocurrency mining?
The answers can expose activity that a simple IP block would miss.
Deadlock Demonstrates the Cost of Data Exfiltration
The LT Group and Fortune Tobacco incident also reinforces another lesson: organizations must assume that ransomware attackers may steal data before encryption or extortion.
This changes incident response priorities.
A company cannot simply focus on restoring servers.
It must determine what was accessed.
It must identify what was copied.
It must establish whether personal information was involved.
It must preserve forensic evidence.
It must understand the
And it must prepare for the possibility that stolen information will be published or redistributed.
What Undercode Say:
Blockchain Is Becoming Another Layer of the Malware Battlefield
The Aeternum development is significant because it demonstrates how attackers continue to repurpose technologies originally designed for legitimate applications.
Blockchain was built to create decentralized trust.
Attackers can abuse that decentralization to create decentralized resilience.
That distinction matters.
The technology itself is not the threat.
The threat comes from malicious actors discovering how to integrate it into an operational malware ecosystem.
C2 Infrastructure Is Evolving
Traditional C2 infrastructure has always been one of the most valuable targets for defenders.
Take down the server, and an attacker can lose control of infected machines.
Block the domain, and communications may stop.
Identify the IP address, and network controls can potentially prevent access.
A blockchain-based C2 model attempts to weaken those defensive advantages.
Instead of placing all operational dependency on one server, attackers can distribute portions of their infrastructure across systems that were never designed to function as traditional malware infrastructure.
Smart Contracts Can Become Operational Infrastructure
The important concept is not simply “malware using blockchain.”
It is the transformation of a smart contract into a component of an attack-control architecture.
The contract can potentially store information.
The malware can retrieve that information.
The attacker can update blockchain-controlled data.
The infected system can interpret the returned information.
This creates a communication mechanism that does not behave exactly like conventional C2 traffic.
Public Does Not Mean Harmless
Blockchain activity is often visible.
That might sound like an advantage for defenders.
But visibility does not automatically equal control.
Security researchers can observe transactions and contract activity while attackers continue using the same public infrastructure.
The challenge becomes attribution and disruption.
Knowing where malicious information is stored is not necessarily the same as being able to remove it.
RPC Providers Become an Important Defensive Layer
Security teams should begin treating blockchain RPC traffic as part of modern threat hunting.
A corporate workstation suddenly communicating with multiple blockchain RPC endpoints may deserve investigation.
That does not mean every blockchain connection is malicious.
Developers, financial applications, security tools, browsers, and legitimate business applications can all interact with blockchain infrastructure.
The key is context.
XWorm Changes the Risk Profile
If XWorm is successfully deployed after the initial compromise, the attacker can potentially obtain substantial control over the endpoint.
Remote-access malware can provide a bridge to credential theft, surveillance, persistence, lateral movement, and additional payload deployment.
The blockchain component may therefore represent only one stage of a larger attack chain.
XMRig Reveals Another Monetization Strategy
Cryptocurrency mining malware represents a different type of criminal objective.
Instead of stealing documents, the attacker monetizes processing power.
This creates an important detection opportunity.
A compromised endpoint running XMRig may exhibit unusual CPU consumption, increased fan activity, reduced performance, and persistent resource utilization.
Security monitoring can identify these signals even when traditional malware signatures fail.
Deadlock Shows Why Ransomware Is Now a Data Security Problem
Organizations once viewed ransomware primarily as an availability problem.
Systems were encrypted.
Operations stopped.
Backups were restored.
Today, that model is incomplete.
Data theft turns ransomware into a confidentiality problem as well.
The attacker can maintain leverage even when the victim has strong backups.
The 27 GB Figure Should Not Be Treated as a Simple Statistic
File volume alone does not measure impact.
The sensitivity of the records matters more.
A relatively small collection of passports and financial documents can create more harm than terabytes of meaningless operational data.
This is why classification and data mapping are essential defensive capabilities.
Identity Information Creates Long-Term Risk
A compromised password can be changed.
A stolen passport record is different.
Personal identity information can remain valuable for years.
Organizations therefore need to consider not only immediate operational damage but also the potential downstream effects of identity exposure.
Financial Records Increase Extortion Pressure
Financial documents can be particularly powerful in extortion campaigns.
They may contain account details, transaction information, debt information, tax records, supplier relationships, or internal financial structures.
Attackers can use such material to demonstrate that their intrusion was successful.
Silence Is Not Recovery
The reported 72-hour period is a reminder that an attacker becoming quiet does not necessarily mean the incident has ended.
They may be preparing publication.
They may be negotiating internally.
They may be moving stolen data.
They may be testing additional persistence.
Incident responders should therefore continue monitoring even after the visible phase of an attack appears to stop.
Security Teams Should Correlate Network and Endpoint Telemetry
A blockchain RPC request becomes far more suspicious when it is associated with an unknown executable.
Likewise, XMRig activity becomes far more concerning when it appears alongside suspicious persistence.
The strongest detection strategy combines endpoint, network, identity, DNS, process, and authentication telemetry.
C2 Detection Must Become Behavioral
Static indicators eventually expire.
Domains disappear.
IPs change.
Malware samples are repacked.
Attackers alter infrastructure.
Behavioral indicators are harder to eliminate.
Repeated unusual RPC requests, suspicious process trees, encoded command retrieval, and abnormal outbound connections can remain useful even when specific indicators change.
Ransomware Defense Starts Before Encryption
Organizations should detect data theft before the ransom note appears.
Large outbound transfers.
Archive creation.
Credential dumping.
Unusual administrative activity.
Remote-access tools.
Shadow-copy manipulation.
Backup access.
These signals can reveal an intrusion during the critical window before widespread encryption.
Blockchain Intelligence Should Enter Threat Hunting
Threat hunters should consider blockchain infrastructure when investigating unusual malware activity.
Contract addresses can become indicators.
Function names can become behavioral clues.
Transaction timing can become useful context.
RPC endpoints can become network indicators.
The blockchain itself can provide additional intelligence for understanding the attacker’s infrastructure.
The Attack Surface Is Expanding
The modern enterprise is connected to thousands of services.
Every new integration creates potential operational value.
It can also create a new avenue for abuse.
Security teams should therefore maintain visibility over unexpected technology dependencies instead of assuming that only conventional web infrastructure matters.
The Future Will Reward Detection Over Blocking
Blocking remains useful.
But attackers increasingly design systems that can survive individual blocks.
A resilient defense must detect the behavior, identify the compromised host, isolate it, investigate persistence, and eliminate the complete attack chain.
Aeternum and Deadlock Send the Same Warning
One incident demonstrates infrastructure innovation.
The other demonstrates extortion pressure.
Together they show that cybercrime is becoming increasingly adaptable.
Attackers are not waiting for organizations to solve yesterday’s problems.
They are building around the defenses already deployed.
The Most Dangerous Assumption Is That One Control Is Enough
Firewalls are not enough.
Antivirus is not enough.
Backups are not enough.
MFA is not enough.
EDR is not enough.
Threat intelligence is not enough.
Security comes from overlapping controls that compensate when one layer fails.
Organizations Need an Attack-Chain Mindset
Instead of asking whether a single indicator is malicious, defenders should ask how multiple indicators connect.
Initial access.
Execution.
Persistence.
C2.
Credential theft.
Lateral movement.
Exfiltration.
Encryption.
Extortion.
That sequence provides a much stronger framework for incident detection.
Blockchain C2 Is a Signal of Broader Innovation
Even if blockchain-based C2 remains relatively uncommon compared with conventional infrastructure, its existence matters.
Attackers experiment constantly.
Techniques that work in limited campaigns can eventually become standardized.
Security teams should therefore monitor emerging techniques before they become mainstream.
Data Security and Network Security Are Converging
The Deadlock incident demonstrates why these disciplines can no longer be treated separately.
A network intrusion can become a privacy incident.
A stolen credential can become a ransomware event.
A malicious endpoint can become a data-exfiltration platform.
Modern security architecture must connect these domains.
The Human Element Still Matters
Technology can detect unusual activity.
People still need to interpret it.
A suspicious RPC connection may be ignored as harmless traffic.
A high-CPU process may be dismissed as a software problem.
A strange login may be overlooked.
Strong security teams connect these seemingly unrelated events.
Preparation Determines the Outcome
Organizations that already know where sensitive data lives can respond faster.
Organizations with tested backups recover faster.
Organizations with centralized logging investigate faster.
Organizations with established incident-response procedures make decisions faster.
Preparation reduces the
The Threat Is Moving Faster Than Conventional Security Models
Cybersecurity teams must continually adapt to new infrastructure.
Blockchain is one example.
Cloud services are another.
Legitimate remote-management software is another.
The recurring pattern is simple: attackers exploit trust.
Trust Is Becoming an Attack Surface
A blockchain network is trusted.
A cloud service is trusted.
A remote-access tool may be trusted.
A legitimate application may be trusted.
Attackers increasingly hide inside that trust.
Detection Engineering Must Follow the Adversary
Defensive controls should evolve according to observed attacker behavior.
When attackers change C2 methods, detection logic must change.
When attackers increase data theft, exfiltration monitoring must improve.
When attackers abuse legitimate tools, application allowlists and behavioral monitoring become more important.
The Goal Is Not Perfect Prevention
No organization can guarantee that every intrusion will be stopped.
The practical objective is to reduce attacker dwell time.
Detect quickly.
Contain quickly.
Investigate quickly.
Recover quickly.
The shorter the
The Philippine Incident Reinforces the Same Lesson
Sensitive corporate data can become a weapon after theft.
The impact can extend beyond encrypted systems and disrupted operations.
Customers, employees, suppliers, executives, and business partners can all become part of the aftermath.
Security Leaders Should Treat Data as a High-Value Asset
Protecting servers is not enough.
Organizations must understand the information stored on those servers.
The most sensitive databases require stronger controls.
Access should be limited.
Monitoring should be continuous.
Unusual extraction should trigger investigation.
Aeternum Shows That Infrastructure Can Become Malware
The malware itself is only one part of the equation.
The infrastructure supporting it can determine how resilient an operation becomes.
That is why defenders must study not only malicious binaries but also the communication mechanisms surrounding them.
The Next Generation of C2 Will Be More Creative
Attackers have already experimented with DNS, social media, cloud storage, public paste services, compromised websites, messaging platforms, and other legitimate systems.
Blockchain represents another addition to that toolbox.
Future campaigns may combine several of these mechanisms simultaneously.
Defenders Must Think in Systems
A single alert rarely explains an intrusion.
A collection of weak signals can.
The strongest security programs therefore build relationships between events instead of evaluating them in isolation.
The Bottom Line
Aeternum’s Polygon-based C2 activity and the Deadlock attack against LT Group and Fortune Tobacco illustrate two increasingly important realities.
Cybercriminals are becoming more creative with infrastructure.
And stolen information is becoming just as valuable as encrypted systems.
Organizations that want to stay ahead must prepare for both.
Deep Analysis: Investigating Blockchain C2 and Ransomware Indicators
Check Suspicious Outbound Connections
ss -tunap
This command provides visibility into active TCP and UDP connections and can help investigators identify unexpected outbound communication.
Search for Unusual RPC Traffic
sudo tcpdump -i any -nn 'tcp port 80 or tcp port 443'
Network captures can help determine whether suspicious processes are repeatedly contacting external infrastructure.
Identify High-CPU Processes
ps aux --sort=-%cpu | head -20
Unexpected sustained CPU usage can be an indicator of unauthorized cryptocurrency mining.
Inspect Running Processes
ps auxww
Investigators should compare unfamiliar processes against approved software inventories.
Review Persistence Mechanisms
systemctl list-unit-files --state=enabled
Unexpected services can reveal persistence mechanisms installed during an intrusion.
Inspect Scheduled Tasks
crontab -l sudo ls -la /etc/cron.
Attackers frequently use scheduled execution to maintain persistence.
Search Authentication Logs
sudo journalctl --since "24 hours ago" | grep -Ei 'ssh|sudo|authentication|failed'
Authentication anomalies can help establish whether compromised credentials were used.
Investigate Recently Modified Files
find /var /tmp /opt -type f -mtime -2 2>/dev/null
Recent modifications can help identify newly deployed tools or altered configuration files.
Examine DNS Resolution
resolvectl statistics
DNS telemetry can provide additional context when investigating unusual outbound activity.
Search for Large Archives
find / -type f ( -name ".zip" -o -name ".7z" -o -name ".rar" ) -size +100M 2>/dev/null
Unexpected large archives may warrant investigation because attackers sometimes package stolen information before exfiltration.
Look for Cryptocurrency Mining Indicators
pgrep -af xmrig
This can quickly identify processes whose command line contains the XMRig executable name.
Investigate Suspicious Network Processes
sudo lsof -i -n -P
This connects network sockets with processes, making it easier to determine which application is responsible for an unusual connection.
Preserve Evidence Before Cleaning
sudo journalctl --no-pager > incident-journal.txt
Investigators should preserve relevant logs before remediation destroys useful evidence.
Build a Timeline
stat /path/to/suspicious/file
File metadata can help investigators establish when suspicious artifacts were created or modified.
Review Executable Locations
find /tmp /var/tmp /dev/shm -type f -executable -ls 2>/dev/null
Temporary directories are worth examining because malicious programs may be staged there.
Investigate Unexpected Services
systemctl --type=service --state=running
Unknown services should be validated against the
Search for Suspicious Shell History
sudo grep -RniE 'curl|wget|nc |bash -c|chmod +x' /root /home 2>/dev/null
This can reveal potentially suspicious command activity, although shell history should never be treated as complete forensic evidence.
Monitor for Data Exfiltration
sudo iftop
Unexpected sustained outbound traffic can provide an early warning of large-scale data transfer.
Isolate Confirmed Compromised Hosts
sudo ip link set dev eth0 down
Network isolation can stop an active compromise, but responders should follow organizational incident-response procedures before taking systems offline because doing so can destroy volatile evidence.
The Defensive Objective
The goal is not simply to block Polygon, blockchain infrastructure, or every unfamiliar RPC endpoint.
The goal is to identify whether legitimate software has been replaced, abused, or accompanied by malicious processes.
Likewise, ransomware defense is not simply about restoring encrypted files.
The objective is to discover the intrusion, remove persistence, identify stolen information, contain lateral movement, and prevent the attacker from returning.
Blockchain C2
✅ Supported: The supplied reporting describes Aeternum using Polygon smart-contract infrastructure and RPC queries as part of its C2 mechanism.
Deadlock Incident
✅ Supported: The supplied report identifies LT Group and Fortune Tobacco in the Philippines as victims of a Deadlock ransomware incident involving approximately 14,836 files and 27 GB of data.
Sensitive Data
✅ Supported: The supplied report identifies passports, banking, tax, and debt-related records among the exposed material, making the incident significantly more serious than a routine operational outage.
Prediction
(+1) Blockchain-Based C2 Will Receive More Attention
Security researchers will increasingly monitor public blockchain infrastructure for malware-related activity.
Threat hunters will add smart-contract addresses, RPC endpoints, and suspicious blockchain interactions to their intelligence workflows.
Endpoint security products will likely improve behavioral detection for applications that unexpectedly interact with blockchain infrastructure.
Attackers will continue experimenting with decentralized technologies because infrastructure resilience can make disruption more difficult.
(+1) Ransomware Extortion Will Remain Data-Driven
Criminal groups will continue prioritizing sensitive corporate documents because stolen data provides leverage even when organizations maintain reliable backups.
Financial, identity, tax, healthcare, and legal records will remain particularly valuable targets.
Organizations will increasingly treat ransomware response as both an availability incident and a data-breach investigation.
(-1) Traditional Indicator-Only Defense Will Become Less Effective
Blocking individual IP addresses and domains will provide diminishing returns against adaptive infrastructure.
Static malware signatures will struggle against constantly modified payloads.
Organizations that lack centralized endpoint, identity, network, and data telemetry will have greater difficulty reconstructing sophisticated attacks.
Final Takeaway
The Aeternum campaign and the Deadlock ransomware attack tell two sides of the same cybersecurity story.
One demonstrates how attackers can turn decentralized technology into covert infrastructure.
The other demonstrates how stolen information can become a weapon against a major organization.
Neither threat depends entirely on a single malicious file.
The real danger lies in the ecosystem surrounding the malware: infrastructure, credentials, legitimate services, stolen data, persistence mechanisms, and the ability to adapt when defenders respond.
For security teams, the message is clear.
Monitor behavior, not just indicators.
Protect sensitive information as aggressively as critical systems.
Investigate unusual blockchain communication.
Watch for unauthorized remote-access tools and cryptocurrency miners.
Maintain offline and tested backups.
Prepare for data theft before ransomware encryption begins.
And above all, assume that modern attackers will look for the defensive blind spots that yesterday’s security architecture was never designed to cover.
▶️ Related Video (84% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
