{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Blockchain-based C2 infrastructure is immutable and cannot be taken down by traditional law enforcement domain seizures. Hunting for the unique communication signature of Aeternum is the only durable way to find this threat as it rotates its smart contract addresses." }, "name": "Aeternum Decentralized C2 and Telegram Exfiltration", "type": "investigation", "labels": [ "hunt", "attack.t1102.001", "attack.t1071.001", "attack.t1105", "attack.t1567.002", "attack.t1041" ], "series": { "slug": "the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications", "index": 2, "title": "The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications", "total": 2 }, "related": [ { "hunt": "aeternum-initial-infection", "reason": "This hunt focuses on the C2 and exfiltration lifecycle; the initial execution and unpacking are handled in the sibling hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "aeternum-loader-persistence-execution", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard detection rule might alert on any Telegram connection; this hunt specifically correlates the sequence of a rare blockchain RPC lookup followed by a unique Telegram User-Agent and the loading of specific botnet modules, reducing the false positives associated with legitimate development activity.", "coverage": [ { "stage": "blockchain-c2-communication", "steps": [ "dns-lead-to-decentralized-infra" ], "status": "covered" }, { "stage": "payload-download-and-loading", "steps": [ "recon-and-module-artifacts" ], "status": "covered" }, { "stage": "data-exfiltration-via-telegram", "steps": [ "telegram-http-exfiltration", "recon-and-module-artifacts" ], "status": "covered" }, { "stage": "aeternum-initial-execution", "reason": "Belongs to another part of the 'The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications' series.", "status": "out_of_scope" }, { "stage": "persistence-via-startup-folder", "reason": "Belongs to another part of the 'The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications' series.", "status": "out_of_scope" }, { "stage": "auxiliary-binary-execution", "reason": "Belongs to another part of the 'The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Aeternum Loader Execution", "slug": "aeternum-initial-execution", "tactic": "execution", "techniques": [ "T1204.002" ], "observables": [ "Build.exe", "UPX-packed binary" ] }, { "name": "Persistence via Startup Folder", "slug": "persistence-via-startup-folder", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "AppData\\Local", "Wmi_Framework_APIKEY_wmsnet_*.lnk" ] }, { "name": "Auxiliary Binary Execution", "slug": "auxiliary-binary-execution", "tactic": "execution", "techniques": [ "T1106" ], "observables": [ "wmiframework.exe", "ZrvEsJQzWQ.exe", "STAAAAAS.exe" ] }, { "name": "Blockchain-based C2 Communication", "slug": "blockchain-c2-communication", "tactic": "command-and-control", "techniques": [ "T1102.001", "T1071.001" ], "observables": [ "polygon-mumbai-bor-rpc.publicnode.com", "0xb68d1809", "getDomain()" ] }, { "name": "Payload Download from GitHub", "slug": "payload-download-and-loading", "tactic": "command-and-control", "techniques": [ "T1105" ], "observables": [ "github.com", "DotNetZip.dll", "putty.exe" ] }, { "name": "Data Exfiltration via Telegram API", "slug": "data-exfiltration-via-telegram", "tactic": "exfiltration", "techniques": [ "T1567.002", "T1041" ], "observables": [ "api.telegram.org", "SystemInfo Bot/2.0", "screenshot.png", "/sendDocument" ] } ], "summary": "Aeternum is a C++ botnet loader that leverages the Polygon blockchain's smart contracts for decentralized command-and-control infrastructure. The loader establishes persistence via the Windows Startup folder and retrieves instructions through Polygon RPC endpoints before downloading secondary payloads from GitHub and exfiltrating system data via the Telegram API." }, "severity": "high", "rationale": "Focus on the general endpoint estate, prioritizing systems with developers or administrators who might legitimately use blockchain RPCs, to distinguish them from infected workstations.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is using public blockchain RPC endpoints to retrieve C2 instructions and the Telegram Bot API to exfiltrate system reconnaissance data, evading traditional domain-based filtering.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames to filter on, typically identified in the initial DNS lead step." }, "exfil_domains": { "from": { "ref": "unit42-aeternum-c2", "kind": "article", "observed": "2026-08-10" }, "type": "list[domain]", "default": [ "api.telegram.org", "github.com" ], "description": "Domains used for exfiltration and payload acquisition." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "rpc_endpoints": { "from": { "ref": "unit42-aeternum-c2", "kind": "article", "observed": "2026-08-10" }, "type": "list[domain]", "default": [ "polygon-mumbai-bor-rpc.publicnode.com" ], "description": "Blockchain RPC endpoints used for decentralized C2." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/", "name": "Unit 42 \u2014 The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations" } ], "blind_spots": [ { "id": "no-http-body-visibility", "risk": "An analyst can see traffic to a public RPC node but cannot confirm it is malicious without seeing the getDomain() method in the body.", "stage": "blockchain-c2-communication", "question": "whether the JSON-RPC POST request contains the Aeternum-specific method 0xb68d1809", "requires": "hb_http_activity with request_body" }, { "id": "tls-encrypted-exfil", "risk": "While the User-Agent is visible, the actual data leaving the estate is hidden by Telegram's encryption.", "stage": "data-exfiltration-via-telegram", "question": "the exact content of the exfiltrated ZIP or PNG file", "requires": "TLS inspection for api.telegram.org" } ] }, "name": "Aeternum Decentralized C2 and Telegram Exfiltration", "description": "This hunt targets the network-centric lifecycle of the Aeternum botnet. It first identifies hosts communicating with decentralized blockchain infrastructure (Polygon) and social media APIs (Telegram). It then correlates these connections with specific behavioural markers, such as the SystemInfo Bot User-Agent and the loading of the DotNetZip.dll module. By fanning out across DNS, HTTP, and module telemetry, the hunt identifies the full scope of a blockchain-coordinated intrusion." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications", "index": 2, "title": "The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications", "total": 2 }, "coverage": [ { "stage": "blockchain-c2-communication", "steps": [ "dns-lead-to-decentralized-infra" ], "status": "covered" }, { "stage": "payload-download-and-loading", "steps": [ "recon-and-module-artifacts" ], "status": "covered" }, { "stage": "data-exfiltration-via-telegram", "steps": [ "telegram-http-exfiltration", "recon-and-module-artifacts" ], "status": "covered" }, { "stage": "aeternum-initial-execution", "reason": "Belongs to another part of the 'The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications' series.", "status": "out_of_scope" }, { "stage": "persistence-via-startup-folder", "reason": "Belongs to another part of the 'The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications' series.", "status": "out_of_scope" }, { "stage": "auxiliary-binary-execution", "reason": "Belongs to another part of the 'The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications' series.", "status": "out_of_scope" } ], "rationale": "An intruder is using public blockchain RPC endpoints to retrieve C2 instructions and the Telegram Bot API to exfiltrate system reconnaissance data, evading traditional domain-based filtering.", "blind_spots": [ { "id": "no-http-body-visibility", "risk": "An analyst can see traffic to a public RPC node but cannot confirm it is malicious without seeing the getDomain() method in the body.", "stage": "blockchain-c2-communication", "question": "whether the JSON-RPC POST request contains the Aeternum-specific method 0xb68d1809", "requires": "hb_http_activity with request_body" }, { "id": "tls-encrypted-exfil", "risk": "While the User-Agent is visible, the actual data leaving the estate is hidden by Telegram's encryption.", "stage": "data-exfiltration-via-telegram", "question": "the exact content of the exfiltrated ZIP or PNG file", "requires": "TLS inspection for api.telegram.org" } ], "scoping_notes": "Focus on the general endpoint estate, prioritizing systems with developers or administrators who might legitimately use blockchain RPCs, to distinguish them from infected workstations.", "beyond_detection": "A standard detection rule might alert on any Telegram connection; this hunt specifically correlates the sequence of a rare blockchain RPC lookup followed by a unique Telegram User-Agent and the loading of specific botnet modules, reducing the false positives associated with legitimate development activity." } }, { "id": "dns-lead-to-decentralized-infra", "type": "query", "label": "DNS lookups to blockchain and exfil domains", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_dns_activity WHERE (instr(',' || '{{rpc_endpoints}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ORDER BY lookup_count DESC", "surface": "hb_dns_activity", "description": "Identify hosts communicating with decentralized RPC nodes or the Telegram API to establish a lead list.", "expected_signal": "A list of hosts contacting Polygon or Telegram. Common developer activity may appear; prevalence will help filter noise in later steps." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "DNS lookups to blockchain and exfil domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_dns_activity WHERE (instr(',' || '{{rpc_endpoints}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ORDER BY lookup_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of hosts contacting Polygon or Telegram. Common developer activity may appear; prevalence will help filter noise in later steps.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "query_hostname" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "telegram-http-exfiltration", "type": "query", "label": "Telegram API exfiltration traffic", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, user_agent, http_method, time FROM hb_http_activity WHERE (LOWER(user_agent) LIKE 'systeminfo bot%' OR LOWER(url_path) LIKE '%/senddocument%') AND LOWER(url_hostname) = 'api.telegram.org' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Find the specific HTTP User-Agent and URI paths used by the Aeternum exfiltration module, restricted to the lead host list.", "expected_signal": "POST requests to /sendDocument with the SystemInfo Bot User-Agent from lead hosts. This is a high-confidence indicator of the exfiltration phase." }, "parents": [ { "id": "dns-lead-to-decentralized-infra" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Telegram API exfiltration traffic", "reads": [ "device_hostname", "http_method", "time", "url_hostname", "url_path", "user_agent" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, user_agent, http_method, time FROM hb_http_activity WHERE (LOWER(user_agent) LIKE 'systeminfo bot%' OR LOWER(url_path) LIKE '%/senddocument%') AND LOWER(url_hostname) = 'api.telegram.org' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "POST requests to /sendDocument with the SystemInfo Bot User-Agent from lead hosts. This is a high-confidence indicator of the exfiltration phase.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "recon-and-module-artifacts", "type": "query", "label": "Malicious module and reconnaissance artifacts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, module_name AS artifact, process_name, time, 'module_load' AS type FROM hb_module_activity WHERE LOWER(module_name) = 'dotnetzip.dll' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') UNION ALL SELECT device_hostname, file_name AS artifact, process_name, time, 'file_creation' AS type FROM hb_file_activity WHERE LOWER(file_name) = 'screenshot.png' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_module_activity", "description": "Identify the loading of the botnet downloader module and the creation of exfiltration files on lead hosts.", "expected_signal": "The loading of dotnetzip.dll or the creation of screenshot.png specifically on hosts identified as having blockchain or Telegram network activity." }, "parents": [ { "id": "dns-lead-to-decentralized-infra" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Malicious module and reconnaissance artifacts", "reads": [ "device_hostname", "module_name", "process_name", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT device_hostname, module_name AS artifact, process_name, time, 'module_load' AS type FROM hb_module_activity WHERE LOWER(module_name) = 'dotnetzip.dll' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') UNION ALL SELECT device_hostname, file_name AS artifact, process_name, time, 'file_creation' AS type FROM hb_file_activity WHERE LOWER(file_name) = 'screenshot.png' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "The loading of dotnetzip.dll or the creation of screenshot.png specifically on hosts identified as having blockchain or Telegram network activity.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-aeternum-evidence", "type": "analytic", "label": "Triage Aeternum evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "dns-lead-to-decentralized-infra", "telegram-http-exfiltration", "recon-and-module-artifacts" ], "objective": "Determine if any host has successfully retrieved commands via Polygon RPC and exfiltrated data via Telegram, citing the User-Agent, module loading, and screenshot creation.", "description": "Correlate the DNS, HTTP, and module findings to confirm a decentralized C2 session and subsequent exfiltration.", "max_iterations": 6, "expected_signal": "A structured verdict per host identifying the timeline from blockchain lookup to Telegram exfiltration.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign based on the presence of the full chain." }, "parents": [ { "id": "telegram-http-exfiltration", "kind": "merge" }, { "id": "recon-and-module-artifacts", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict identifies hosts with confirmed Aeternum exfiltration markers such as the SystemInfo Bot User-Agent or DotNetZip module load", "condition": "the triage verdict identifies hosts with confirmed Aeternum exfiltration markers such as the SystemInfo Bot User-Agent or DotNetZip module load", "blind_spot": "no-http-body-visibility", "confidence": "high", "description": "Automate containment if the high-confidence Telegram exfiltration markers are matched with blockchain C2 leads.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-aeternum-evidence" } ] }, { "id": "isolate-infected-host", "type": "action", "label": "Isolate infected host", "config": { "target": "endpoint", "description": "Prevent further exfiltration and wait for IR to recover the loader and payloads.", "instructions": "Isolate the host from the network. Capture any running processes communicating with api.telegram.org.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Analyst manual review", "config": { "assignee": "analyst", "description": "Review indeterminate results where blockchain traffic was seen without specific exfiltration markers.", "instructions": "Examine the process trees for hosts contacting Polygon RPC endpoints. Look for C++ compiled binaries that do not belong to legitimate blockchain development tools." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-infected-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Record findings and ensure the Telegram User-Agent is promoted to a standing rule.", "instructions": "Log the number of hosts identified. If Aeternum was confirmed, ensure the HTTP User-Agent and screenshot file name patterns are added to the detection backlog." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-manual-review" } ] } ] }