CuraSec

tag: Blockchain-C2 · 2 items

Plan archived ChainScript RAT Uses Polygon Blockchain for C2 Rotation via ClickFix Lures
2026-09-21 · The Hacker News · source ↗ #rat#clickfix#blockchain-c2
  • Engineer — Learn: Using a public blockchain (Polygon) for C2 infrastructure rotation is a novel evasion technique worth understanding for future detection architecture; no running system needs patching, but this reinforces restricting outbound RPC calls from endpoints to blockchain nodes.
  • SOC/IR — Plan: Build or tune detections for ClickFix-style user-execution lures impersonating Teams/Zoom/Spotify, and add hunting logic for endpoints making Polygon RPC calls; no specific IOCs are published yet, so schedule this as a detection engineering task rather than an immediate sweep.
  • Leader — Skip
Plan archived GoCaracal Malware Uses Ethereum Smart Contract for C2 Resilience
2026-08-27 · The Hacker News · source ↗ #malware#blockchain-c2#dark-caracal
  • Engineer — Learn: The blockchain-based C2 technique — resolving replacement C2 addresses from an Ethereum smart contract — is a novel evasion that standard domain-block controls won’t catch; worth reviewing egress filtering to include RPC/blockchain API endpoints.
  • SOC/IR — Plan: Add detection coverage for unexpected Ethereum RPC calls or blockchain API queries originating from endpoints, as this C2 pattern bypasses conventional domain-blocking; no specific IOCs were released, so broader TTP-level hunting is the near-term action.
  • Leader — Skip