Supply Chain Malware Uses Blockchain Transactions to Dynamically Rotate Command-and-Control Servers

Unit 42 reports on supply-chain malware campaigns (ChainDrop, PolinRider) that hide loaders in developer packages and workspaces to steal cloud and CI/CD credentials; these infections (hundreds of npm packages) use blockchain-based lookup techniques (smart contracts, calldata transactions, and zero-value "NullReceiver" transfers) to publish and rotate C2 endpoints, allowing attackers to redirect compromised hosts without changing embedded domains or IPs. The activity is linked to broader intrusions including North Korean operations, and defenders are advised to monitor unexpected blockchain traffic from development tools and CI/CD environments.