The botnet you can't unplug: blockchain C2 in 2026

Every piece of malware needs to phone home. Somewhere there’s a server telling infected machines what to do next. For decades, the defender’s playbook was simple: find that server, take it down, and the whole operation goes dark.

In 2026, that playbook is breaking. More and more attackers store the address of their server on a public blockchain, where nobody can delete it. Not the police, not the hosting company, not the blockchain’s own developers.

Here’s how it works, where it showed up this year, and what defenders can still do about it.

The idea: a note under a park bench

Spies call it a dead drop. You leave a note in an agreed place, and your contact picks it up later. Malware does the same. Instead of hardcoding its server address, it looks it up at runtime somewhere the attacker controls. That used to be a Telegram bio, a paste site or a GitHub gist. All of those can be reported and removed.

A blockchain can’t. The attacker writes the current server address to the chain. Infected machines read it, connect, and get their orders. When defenders block that server, the attacker writes a new address and every infected machine follows. One researcher measured a full campaign and found the attacker spent about 0.000111 ETH in total managing its servers on-chain. Less than a coffee.

The note gets hidden in a few ways:

• Smart contracts. The address sits in contract storage. This is the classic “EtherHiding”.
• Transaction data. Encoded in Bitcoin’s OP_RETURN field, in transaction input data, or in memo fields.
• Blockchain domain names. ENS (.eth), Solana Name Service (.sol) or TON DNS records instead of normal DNS.
• Phantom wallets. The newest trick: the server’s IP address is encoded in the bytes of a wallet address nobody owns, and the attacker sends zero-value transfers to it as a signal.

For the technical crowd: this is MITRE ATT&CK T1102.001 (Web Service: Dead Drop Resolver). The idea isn’t new. A Necurs botnet variant kept its server domains on Namecoin back in 2013, and the Glupteba botnet used Bitcoin OP_RETURN in 2019. Smart contracts arrived in 2023, when the ClearFake gang moved its malware into contracts on BNB Smart Chain after Cloudflare cracked down on its servers. What changed in 2026 is the scale.

The numbers

In September, Chainalysis published the most complete data so far. Blockchain-assisted attacks grew 5.2x year over year (+420%). Measured another way, malicious on-chain writes rose from 2.06 to 11.1 per day (+440%) since mid-2025. Chainalysis tracks more than 15 campaigns across five blockchains.

The bigger shift is who’s doing it. Until early 2024, almost all of it was ordinary cybercrime. By Q2 2026, state-linked groups produced about two-thirds of new activity and half of all activity tracked. Three operations stand out:

• North Korea (UNC5342) targets crypto developers with fake job interviews. Its malware reads a pointer from TRON, falls back to Aptos if that fails, and then fetches the encrypted payload from BNB Smart Chain. To shut it down, you’d need to act on three blockchains at once.
• Iran-linked actors hide server data in Bitcoin transactions. The odd detail: the transactions are small payments to a famous Bitcoin address tied to Satoshi Nakamoto. The payment means nothing; the data inside it is the message.
• Russian-speaking criminals sell it as a service. A malware-as-a-service toolkit with a subscription model is sold on criminal forums, and one operator wallet controls a whole fleet of Polygon resolver contracts, one per customer. The same wallet also links to fake stablecoin tokens, clipboard-hijacking campaigns and 50+ resolver contracts on BNB Smart Chain.

Chainalysis blames AI for the acceleration, linking it to unrestricted open-weight Chinese models released in mid-2025. Treat that with some caution: it’s a timing match, not proven cause. Chainalysis also can’t say from chain data how many of these attacks actually succeeded.

Where it showed up in 2026

Regular people

The most likely contact point is a fake CAPTCHA. A ClickFix campaign tracked by GuidePoint, active from late 2025 to at least August 2026, used Polygon smart contracts as a live address book. You land on a hacked site, it asks you to “prove you’re human” by pasting a command, and the malware you just ran checks the blockchain to find its server. In one case the malicious script was hidden in a hacked WordPress site’s robots.txt file.

Hotels got their own version. Since late May, staff at Japanese hotels that partner with Booking.com have received emails posing as angry guest complaints. The attachment installs a remote access trojan that reads its server address from a TON smart contract. A newer wave of the same lure delivers either TONResolver or EtherRAT, which uses Ethereum.

Developers

The big one was ChainDrop on August 4. This self-spreading worm poisoned 444 npm packages and 2,212 versions in under four hours, starting with keyv@6.0.0. A few details worth knowing:

• It reads its server list from an Ethereum contract and tries 75 public RPC endpoints in turn. If the chain lookup fails, it searches GitHub for a signed commit and only trusts a new address after checking the signature. Defenders can’t just plant a fake address to hijack the bots.
• It stops if the system language is Russian, a classic sign of Russian-speaking authors.
• Its commits to victims’ repos were signed as claude, to look like an AI coding assistant’s work, and it planted hooks that run when you open the repo in VS Code or start a Claude Code session.
• It got into the CI pipeline of Backstage, the CNCF developer portal. The repo had a proper lockfile, but its end-to-end tests install a fresh app at the latest versions, so they pulled the poisoned package anyway. StepSecurity found no evidence of stolen long-lived credentials there, but the payload ran and reached its server.

Earlier, in March, CanisterWorm became the first known malware to use a canister on the Internet Computer (ICP) blockchain as its control point. When it wasn’t serving malware, the canister pointed visitors to a Rick Roll. One version wiped machines set to Iran’s time zone or with Farsi as the default language.

IoT

Dysphoria infected around 200,000 routers, cameras and other devices. It looks up its servers through domains like burrberry.eth and ukranianhorseriding.eth, whose TXT records hold fake IPv6 strings that hide the real IP. A newer variant turns infected devices into relays, so the real server never shows up in bot traffic. The operators advertise 4 Tbps of DDoS power for sale, and their download server greets visitors with an FTP banner mocking journalist Brian Krebs.

The timing is the real story. A March law enforcement operation seized servers and domains. A few months later, Dysphoria had none of those in a form anyone could seize. It’s a direct answer to successful takedowns.

Why defenders hate it

There’s nobody to call. No registrar, no hosting provider, no DNS to sinkhole. Even ICP, which has a governance process, was slow: the CanisterWorm canister came down about 26 hours after it was publicly exposed.

Blocklists go stale instantly. Some campaigns hand out a new domain per visit. Blocking one does nothing for the next victim.

It looks like normal traffic. Infected machines don’t run their own blockchain node. They use the same public gateways (Infura, Alchemy, Ankr and others) that millions of real wallets use, often through Cloudflare or Amazon. Blocking all of them breaks every legitimate crypto app, and the attacker could still run a node of their own.

Reading leaves no trace. Malware fetches the data with read-only calls that create no transaction. You can see what the attacker wrote, but not who read it.

Strings don’t help. ChainDrop calls the contract through a hashed function selector, so a readable function name never appears in the code. Dysphoria encrypts all its strings with a modified RC4.

Where your data actually goes

Stolen data usually doesn’t end up on the blockchain. The chain only holds the directions. The malware reads them and then does the real work off-chain: stealing credentials, remote access, emptying wallets. For DLP that means exfiltration goes to ordinary-looking domains that keep changing.

ICP is the exception, because canisters can accept web requests. In April’s CanisterSprawl wave, stolen data went straight into an ICP canister, so the blockchain became the drop box. Attackers also abuse the victim’s own trusted services: CanisterWorm’s fallback created a public repo in the victim’s own GitHub account and uploaded the encrypted loot there.

One trap for incident responders: ChainDrop installs a small service that checks the stolen GitHub token every 60 seconds for 24 hours and runs an attacker payload when the token gets revoked. “Rotate everything now” can set off the damage. Remove the monitor first, then rotate.

The attacker’s weak spot: everything is public

The feature that protects attackers also exposes them. Every server rotation is a public, permanent, timestamped transaction. Defenders can query the same contract the malware uses and get the live server address before the next victim connects. GuidePoint found an active server just by searching the blockchain for the string /UpdateCheck/. Chainalysis linked campaigns that looked unrelated by following the wallets that deployed and paid for the contracts.

What to do

If you’re a regular user: never paste a command into Run, Terminal or File Explorer because a website told you to. No real CAPTCHA works that way. Be suspicious of attachments in “guest complaint” or “review” emails, and install IDE and browser extensions only from publishers you know.

If you’re on a blue team:

• Ask who talks to the blockchain. Most corporate laptops have no reason to query blockchain RPC endpoints. A script interpreter, browser, Node or Bun process calling one is worth a look. Elastic ships a rule for exactly this.
• Detect sequences, not indicators. For example: scheduled task, then PowerShell, then a Polygon RPC call, then a check-in to an unknown domain. That keeps working long after the domain list goes stale.
• Use the ledger against them. Poll the contracts listed below and push every new server address into your blocklists. In environments with no Web3 business, consider blocking tonapi.io and similar gateways, as Trend Micro suggests for TONResolver.
• Lock down installs. npm 12 blocks preinstall hooks by default; on older versions use --ignore-scripts in CI. Add a minimum release age (a few days) before new versions reach your builds. Remove npm tokens that can publish without 2FA, since ChainDrop only spreads through those.
• Don’t treat provenance as approval. ChainDrop’s first packages came out of the projects’ own release pipelines with valid SLSA provenance. Provenance shows where a build came from, not whether the change was authorized.

IOCs for defenders

Domains are defanged. Server domains rotate fast, so treat them as historical. Contract addresses are the durable indicators: monitor them and read their current value instead of only blocking what was published.

ChainDrop (npm worm, August 2026)

CanisterWorm / CanisterSprawl (npm and PyPI worm, March–April 2026)

Dysphoria (IoT botnet, March–July 2026)

EtherHiding, EtherRAT and TONResolver (2026)

Hunting starting points

• Outbound connections to blockchain RPC gateways where the source process is powershell.exe, wscript.exe, mshta.exe, node, bun, python or a browser, on hosts with no Web3 role.
• eth_call JSON-RPC requests (or TON API calls) followed within seconds by a connection to a newly seen domain.
• node or bun launched from a package install step that then contacts RPC providers.
• Write activity to the contracts above. Each setter call means a new server address you can block.

The bottom line

Blockchain C2 doesn’t make malware more dangerous. It makes it harder to kill. The fight moves from “take the server down” to “catch the machine asking where the server is.” That’s harder work for defenders, but not hopeless, because the attacker’s address book is sitting in public for anyone to read.

Sources

Primary research

• Chainalysis, DPRK and Iran are Leading a 5.2x Surge YoY in Blockchain-Assisted Cyberattacks (Sept 2026): https://www.chainalysis.com/blog/etherhiding-blockchain-dead-drops/
• StepSecurity, ChainDrop npm Worm: https://stepsecurity.io/blog/chaindrop-npm-worm
• Elastic Security Labs, Shai-Hulud strikes again: CHAINDROP: https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain
• Trend Micro, TONResolver RAT Abuses TON Blockchain to Target Japan’s Hotel Industry: https://www.trendmicro.com/en/research/26/f/tonresolver.html
• QiAnXin XLab, Dysphoria report: https://blog.xlab.qianxin.com/dysphoria/ (summary: https://securityaffairs.com/196182/malware/dysphoria-botnet-uses-blockchain-domains-to-hide-c2-infrastructure.html)
• Cloud Security Alliance, CanisterWorm notes: https://labs.cloudsecurityalliance.org/research/csa-research-note-canisterworm-blockchain-c2-supply-chain-20/ and https://labs.cloudsecurityalliance.org/research/csa-research-note-trivy-canisterworm-blockchain-c2-supply-ch/
• Cloud Security Alliance, CanisterSprawl: https://labs.cloudsecurityalliance.org/research/csa-research-note-npm-canistersprawl-supply-chain-worm-20260/
• GuidePoint Security, EtherHiding Exposed: https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/
• Cribl, EtherHiding malware campaign on the blockchain: https://cribl.io/blog/cribl-secops-uncovers-etherhiding-malware-campaign-on-the-blockchain/
• Prophet Security, EtherHiding Malware on macOS: https://www.prophetsecurity.ai/blog/etherhiding-malware-macos-blockchain-c2
• Bitdefender, Windsurf IDE Extension Drops Malware via Solana Blockchain: https://www.bitdefender.com/en-us/blog/labs/windsurf-extension-malware-solana
• Crimson7, EtherHiding: When Malware Hides Its C2 on the Blockchain: https://www.crimson7.io/resources/blogs/etherhiding-blockchain-c2-dead-drop-resolver
• Netskope, Blockchain dead drop resolvers explained: https://www.netskope.com/blog/blockchain-dead-drop-resolvers-explained

Detection

• Elastic detection rule, Potential Etherhiding C2 via Blockchain Connection: https://www.elastic.co/guide/en/security/8.19/potential-etherhiding-c2-via-blockchain-connection.html
• Endor Labs, The Unkillable C2: https://www.endorlabs.com/learn/the-unkillable-c2-how-attackers-are-moving-command-and-control-to-the-blockchain
• Sicuranext, ClickFix → EtherHiding → GULoader intrusion: https://blog.sicuranext.com/one-paste-to-rule-them-all-inside-a-clickfix-etherhiding-guloader-intrusion/

Reporting

• EtherRAT (eSentire findings), GBHackers: https://gbhackers.com/ethereum-based-etherrat/
• CanisterWorm Iran wiper, Tom’s Hardware: https://www.tomshardware.com/tech-industry/cyber-security/canisterworm-malware-wipes-iranian-machines-for-no-apparent-reason-sophisticated-attack-spreads-through-npm-packages-and-uses-icp-canister-as-control-surface
• Japan hotels campaign, Infosecurity Magazine: https://www.infosecurity-magazine.com/news/hackers-blockchain-japan-hotels/
• EtherRAT + TONResolver hotel wave, Cyberpress: https://cyberpress.org/hotel-phishing-exploits-blockchains/
• Dysphoria vs. the March takedown: https://blog.fiscybersec.com/dysphoria-botnet-blockchain-c2-en
• On-chain C2 cost measurement (0.000111 ETH): https://medium.com/@rhishav.kanjilal14/dead-drops-on-the-blockchain-a-cross-family-taxonomy-of-on-chain-c2-with-first-hand-reversal-and-e537e11cf8d2