PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT

PHANTOMPULSE is a sophisticated Windows RAT analyzed in detail: it uses three process-injection methods (module stomping, debug-API state machine, and manual mapping), a shared hardware-breakpoint primitive to disable AMSI/WLDP/ETW, scheduled-task persistence, and a blockchain-based C2 resolver (Ethereum/Base/Optimism) that can be sinkholed due to lack of sender verification; analysts provide IOCs (SHA-256s, domains, wallet addresses), describe UAC elevation via the schuac technique, and note strong AI-assisted development fingerprints and links to DPRK-aligned crypto-targeting activity.