PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT

PHANTOMPULSE is a sophisticated Windows remote-access trojan analyzed in this report: it uses direct syscalls, three distinct process-injection techniques (module stomping, debug-API state machine, manual mapping), and a novel hardware-breakpoint primitive to bypass AMSI/WLDP/ETW. The implant resolves its C2 via transaction inputs on Ethereum/Base/Optimism (without sender verification, allowing defenders to sinkhole by posting a crafted transaction), implements scheduled-task persistence and a UAC bypass via the schuac technique, and includes numerous IoCs and behavioral indicators; Elastic links the toolset to DPRK-aligned crypto-targeting clusters.