Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown

Researchers disclosed Aeternum C2, a native C++ botnet loader that stores encrypted commands in smart contracts on the Polygon blockchain and retrieves them via public RPC endpoints, making the C2 takedown-resistant; the malware includes anti-analysis checks and is being sold on underground forums. The report also links the actor LenAI to another crimeware product (ErrTraffic) and documents a separate underground residential proxy service (DSLRoot) operated by an identified individual, which leverages deployed hardware and ADB-capable Android devices to provide anonymized U.S. residential IPs.