Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience

Qrator Labs has shared details on Aeternum C2, a recently discovered botnet loader that relies on the Polygon blockchain for command-and-control (C&C), thus improving its resilience against takedowns.

The malware was first spotted in December 2025, after a threat actor started advertising it on underground forums as operating fully on smart contracts.

The threat actor claimed that commands were delivered to bots encrypted, via multiple RPC (remote procedure call) networks, and validated before execution, completely removing the need for central infrastructure.

The malware was also advertised with anti-VM checks, AV scanning, and support for executing various types of payloads, and was offered at $200 for a lifetime license with panel and build access, or at $4,000 for the full C++ source and ongoing updates.

Bot management is available through a web-based panel that provides the operator with the option to update the available smart contracts with new commands and ...