Aeternum Blockchain C2 Botnet: XWorm, ZingoStealer and XMRig Loader Activity — OTX Detection Pack | Security Arsenal

Threat Summary

The pulse describes a shift from classic centralized botnet infrastructure to blockchain-resident command-and-control. The activity is attributed in OTX to an adversary identified as LenAI and centers on Aeternum, a C++ botnet loader that uses Polygon blockchain smart contracts as the instruction channel instead of a conventional C2 server. Infected hosts query public Polygon RPC endpoints, read instructions written to contracts, decrypt tasking, and stage secondary payloads. Named families in the pulse are XWorm, ZingoStealer and XMRig, which is a practical full monetization chain: remote access for hands-on control, credential and wallet theft for immediate account takeover, and cryptomining for persistent resource abuse.

The collective signal is not a single phishing lure; it is an infrastructure pattern. By putting C2 material on-chain and reaching it through legitimate public RPC services such as endpoints.omniatech.io, polygon-zkevm.drpc.org, polygon-mumbai.gateway.tenderly.co and api.zan.top, the operator gains resilience against takedown and blends malicious control-plane traffic with normal Web3/API traffic. The objective is durable access, credential and crypto-wallet theft, and compute hijacking. The mention of weak PBKDF2HMAC/AES-GCM with self-salting passwords matters for defenders: payload decryption may be recoverable in sandboxes, but network controls cannot rely on decrypting contract data at the perimeter. Prioritize endpoint behavior, RPC destination control, and payload lineage.

Threat Actor / Malware Profile

Aeternum is profiled as a C++ loader/botnet implant whose differentiator is C2 channel design. Distribution is not specified in the pulse, so treat initial access as the common loader economy: malspam, cracked software, SEO-poisoned installers, fake updates, and second-stage delivery from existing RATs. Once executed, the loader fingerprints the host, checks out to attacker-controlled logic, and pulls tasking from Polygon-compatible RPC endpoints. It likely selects from multiple RPC providers for redundancy and may rotate contract addresses or encoded blobs to frustrate naive blocking.

Payload behavior is modular. XWorm provides remote access, keylogging, credential theft and plugin execution. ZingoStealer focuses on browser credentials, cookies, session tokens, crypto wallets, FTP/VPN clients and gaming/chat tokens. XMRig converts compromised hosts into mining capacity and often arrives with watchdog logic. Persistence should be assumed through Run keys, scheduled tasks, service creation, WMI event subscription or startup folder droppers even though the pulse does not enumerate persistence. Anti-analysis is implied by encrypted instructions and self-salting password derivation: expect environment checks, delayed RPC polling, TLS to reputable API hosts, in-memory payload decryption, and string/contract-address obfuscation. The empty MITRE fields in the pulse still map behaviorally to T1071.001 for web protocol C2, T1105 for ingress tool transfer, T1027 for obfuscation, T1555/T1539 for credential and cookie theft, T1496 for resource hijacking, and T1547.001/T1053.005 for likely persistence.

IOC Analysis

The indicator set is dominated by hostnames and domains rather than raw IPs. That reflects the design: the control plane rides on legitimate blockchain RPC infrastructure, while sekirolegion.duckdns.org and cdnjsdelivr.beer look more directly attributable or payload/staging adjacent. Treat the RPC hostnames as high-signal hunt artifacts but low-precision block indicators in isolation, because they are shared services used by benign Web3 developers. Block them only where business use of Polygon/Web3 RPC is absent; otherwise alert on unexpected process ancestry making TLS connections to those hosts.

Operationalize the two SHA256 hashes immediately in EDR blocklists, email detonation, and proxy download controls. Add domains and hostnames to DNS sinkhole, secure web gateway and TLS SNI/JA3 telemetry. Build detections around non-browser, non-Wallet, non-development processes querying RPC endpoints, especially Office, script interpreters, rundll32, regsvr32, mshta, powershell, wscript and unsigned binaries in user profile paths. Useful decoding tooling includes Polygon RPC traces or logs, curl/Postman for eth_call reproduction in a controlled lab, CyberChef for AES-GCM/PBKDF2 experimentation only with captured keys, Wireshark/mitmproxy for TLS metadata, VirusTotal/OTX pivoting, and sandbox memory dumps to recover contract addresses, salts and staged payload URLs. Do not depend on IOC expiry; blockchain C2 makes infrastructure durable, so behavior must outlive the feed.

Detection Engineering

YAML

---
title: Suspicious Process Connecting to Public Polygon RPC Endpoints
id: 9f2a8f1d-3f2a-4f0c-aeternum-rpc-001
status: experimental
description: Detects non-development processes initiating network connections to public Polygon RPC endpoints observed in Aeternum blockchain C2 activity.
author: Security Arsenal
date: 2026/09/10
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|endswith:
      - 'endpoints.omniatech.io'
      - 'polygon-zkevm.drpc.org'
      - 'polygon-mumbai.gateway.tenderly.co'
      - 'api.zan.top'
  selection_proc:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\cmd.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
  filter_known_dev:
    Image|endswith:
      - '\node.exe'
      - '\code.exe'
      - '\hardhat.exe'
      - '\foundry.exe'
  condition: selection_dest and selection_proc and not filter_known_dev
falsepositives:
  - Corporate Web3 development workstations and blockchain infrastructure services
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
---
title: Aeternum Loader Hash or User Profile Payload Execution
id: 9f2a8f1d-3f2a-4f0c-aeternum-loader-002
status: experimental
description: Detects execution of known Aeternum-related loader hashes or suspicious unsigned binaries launched from user-writable locations consistent with XWorm/ZingoStealer staging.
author: Security Arsenal
date: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_hash:
    Hashes|contains:
      - 'SHA256=5BFB25B8255B61E5FFDF6804451534BCFA9F1DFD225E6C8CDCEFB5F50D846898'
      - 'SHA256=1505EDA3DA68E2FF9919B55A31018BD30A991236F041AEE835F3BC4E430CE505'
  selection_path:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_cli:
    CommandLine|contains:
      - 'appdata'
      - 'local\temp'
      - 'roaming'
      - '-enc'
      - ' FromBase64String'
      - 'Invoke-Expression'
      - 'Start-Process -WindowStyle Hidden'
  filter_system:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_hash or (selection_path and selection_cli and not filter_system)
falsepositives:
  - Software updaters and portable applications; validate signer, parent and network destination
level: critical
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059
---
title: Credential Theft and Miner Persistence After RPC Beaconing
id: 9f2a8f1d-3f2a-4f0c-aeternum-post-003
status: experimental
description: Correlates persistence creation with browser credential store access or XMRig command lines after suspicious RPC beaconing.
author: Security Arsenal
date: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_persist:
    CommandLine|contains:
      - 'schtasks /create'
      - 'CurrentVersion\Run'
      - 'wmi/namespace'
      - 'Startup'
  selection_cred:
    CommandLine|contains:
      - 'Login Data'
      - 'Cookies'
      - 'Local State'
      - 'wallet.dat'
      - 'exodus'
      - 'metamask'
      - 'phantom'
  selection_miner:
    CommandLine|contains:
      - 'xmrig'
      - '--donate-level'
      - 'stratum+tcp'
      - 'randomx'
      - '--cpu-max-threads-hint'
  condition: selection_persist and (selection_cred or selection_miner)
falsepositives:
  - Legitimate enterprise miners are rare; browser backup tools may access profile stores but should not create persistence
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1539
  - attack.impact
  - attack.t1496
  - attack.persistence
  - attack.t1547.001

KQL — Microsoft Sentinel / Defender

let RpcHosts = dynamic(['endpoints.omniatech.io','polygon-zkevm.drpc.org','polygon-mumbai.gateway.tenderly.co','api.zan.top']);
let DirectBad = dynamic(['cdnjsdelivr.beer','sekirolegion.duckdns.org']);
let Hashes = dynamic(['5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898','1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce505']);
let Lookback = 14d;
union withsource=src
(DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemoteUrl has_any (RpcHosts) or RemoteUrl has_any (DirectBad)
| extend RpcHit = RemoteUrl has_any (RpcHosts), DirectHit = RemoteUrl has_any (DirectBad)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RpcHit, DirectHit, src),
(DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where SHA256 in~ (Hashes)
   or ProcessCommandLine has_any ('xmrig','stratum+tcp','randomx','Login Data','Local State','wallet.dat','metamask','phantom','exodus','schtasks /create','CurrentVersion\Run')
   or (FolderPath startswith @'C:\Users\' and ProcessCommandLine has_any (' FromBase64String','Invoke-Expression','Start-Process -WindowStyle Hidden'))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Parents=make_set(InitiatingProcessFileName), Cmds=make_set(ProcessCommandLine) by DeviceName, FileName, FolderPath, SHA256, src)
| order by LastSeen desc;

PowerShell

$ErrorActionPreference = 'SilentlyContinue'
$Rpc = @('endpoints.omniatech.io','polygon-zkevm.drpc.org','polygon-mumbai.gateway.tenderly.co','api.zan.top')
$Bad = @('cdnjsdelivr.beer','sekirolegion.duckdns.org') + $Rpc
$Hashes = @('5BFB25B8255B61E5FFDF6804451534BCFA9F1DFD225E6C8CDCEFB5F50D846898','1505EDA3DA68E2FF9919B55A31018BD30A991236F041AEE835F3BC4E430CE505')
Write-Host '[*] DNS cache hits'
Get-DnsClientCache | Where-Object { $n=$_.Name; $Bad | Where-Object { $n -like ('*' + $_ + '*') } } | Select-Object Name,Entry,Data,Status
Write-Host '[*] Active TCP connections to RPC/direct infrastructure'
Get-NetTCPConnection -State Established | ForEach-Object {
  $ip = $_.RemoteAddress
  $dns = (Resolve-DnsName $ip -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty NameHost)
  if ($dns -and ($Bad | Where-Object { $dns -like ('*' + $_ + '*') })) {
    $p = Get-Process -Id $_.OwningProcess
    [pscustomobject]@{Process=$p.ProcessName; PID=$_.OwningProcess; Path=$p.Path; Remote=$ip; Dns=$dns; RemotePort=$_.RemotePort}
  }
} | Format-Table -AutoSize
Write-Host '[*] Persistence artifacts'
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' | Select-Object PSPath,* | Format-List
Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location,User | Format-Table -AutoSize
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|wscript|mshta|rundll32|xmrig|AppData|Temp' -or $_.Actions.Arguments -match 'FromBase64String|Login Data|Local State|stratum\+tcp' } | Select-Object TaskName,TaskPath,State,@{n='Action';e={($_.Actions.Execute + ' ' + $_.Actions.Arguments)}} | Format-List
Write-Host '[*] Hash sweep in high-risk paths'
$paths = @($env:TEMP, "$env:LOCALAPPDATA", "$env:APPDATA", 'C:\ProgramData')
foreach ($path in $paths) {
  Get-ChildItem $path -Recurse -File -Include *.exe,*.dll,*.ps1,*.js,*.vbs,*.bat -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    if ($Hashes -contains $h) { [pscustomobject]@{FOUND=$_.FullName; SHA256=$h; Created=$_.CreationTime; Modified=$_.LastWriteTime} }
  }
}
Write-Host '[*] Browser credential store access indicators'
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data","$env:LOCALAPPDATA\Microsoft\Edge\User Data","$env:APPDATA\Mozilla\Firefox\Profiles" -Recurse -Include 'Login Data','Cookies','Local State','logins.json','key4.db' -ErrorAction SilentlyContinue | Select-Object FullName,LastWriteTime,Length | Sort-Object LastWriteTime -Descending | Select-Object -First 40

Response Priorities

Immediate: Block the two SHA256 hashes in EDR, email and web controls. Add cdnjsdelivr.beer and sekirolegion.duckdns.org to DNS/proxy deny lists. Alert rather than blanket-block public Polygon RPC hosts unless Web3 traffic is out of policy; hunt for script interpreters, Office children, rundll32/regsvr32 and unsigned user-profile binaries connecting to RPC endpoints. Isolate any host with both RPC beacons and miner/credential-store artifacts. Capture memory before reimage to recover contract addresses, salts, wallet targets and staged payloads.
24h: Treat every affected endpoint as credential compromise. Force password resets for users on infected hosts, revoke browser sessions, OAuth grants, SSO refresh tokens, API keys and VPN sessions. Prioritize crypto-wallet exposure: check for MetaMask, Phantom, Exodus, wallet.dat, clipboard hijacking and unauthorized transactions. Reset MFA where cookies or tokens may have been stolen and review impossible travel, mailbox rules and new device enrollments.
1 week: Create a controlled egress category for blockchain RPC and Web3 APIs; require business justification and proxy authentication. Constrain user-writable execution with WDAC/AppLocker, block Office child processes and script-interpreter network egress where feasible, and harden browsers against cookie theft via profile isolation and token binding. Add detections for persistence plus credential-store access, monitor DNS for dynamic DNS and lookalike CDN domains, and validate mining controls by baselining CPU/GPU, stratum traffic and unsigned long-running processes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Aeternum Blockchain C2 Botnet: XWorm, ZingoStealer and XMRig Loader Activity — OTX Detection Pack