This article explains how malware uses blockchain dead drop resolvers to fetch command-and-control pointers at runtime from smart contracts on EVM chains, Solana, and TON instead of hardcoding them. It highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns. #ChainDrop #TroyDen #DeadLock #CLEARSHORT #JADESNOW #GlassWorm #SalatStealer #TONResolver #Ethereum #Polygon #BNBSmartChain #Solana #TON
Keypoints
- Malware is using blockchain dead drop resolvers to retrieve C2 data from public smart contracts at runtime.
- The technique has moved from Telegram bios, paste sites, and GitHub gists to blockchain-based public smart contracts.
- EVM-based loaders use eth_call against Ethereum, Polygon, or BNB Smart Chain to decode a contract response into an IP, URL, domain, JavaScript, or bash stager.
- ChainDrop, also called “mini Shai-Hulud,” compromised more than 440 npm packages and used an Ethereum eth_call dead drop.
- Solana malware abuses transaction memo fields by querying signatures and then fetching transaction data to extract Base64-encoded payloads.
- TON-based malware uses get_domain on smart contracts to retrieve plain C2 domains through tonapi.io or toncenter.
- Defenders should correlate RPC URL, contract address, function selector, decoded result, and process context to distinguish malware from benign crypto activity.
MITRE Techniques
- [T1102.001 ] Web Service: Dead Drop Resolver – Malware fetches C2 at runtime from third-party public locations instead of hardcoding it, including blockchain smart contracts and earlier web services like Telegram bios or paste sites (‘the malware fetches its command and control (C2) address at runtime from a third-party, cyberattacker-controlled location’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – Loaders send JSON-RPC or REST requests to blockchain endpoints such as Infura, Cloudflare, publicnode, tonapi.io, and toncenter to retrieve the dead-drop value (‘the loader posts JSON-RPC to the same high-reputation crypto SaaS hosts’ and ‘issues a single REST GET to tonapi.io or toncenter’).
- [T1027 ] Obfuscated Files or Information – Operators encode C2 pointers as Base64, Base64 plus XOR, gzip plus Base64, or hidden memo payloads, requiring decoding before use (‘Base64, Base64 plus XOR, gzip plus Base64, or a bash one-liner’ and ‘pull a payload … from the memo instruction’).
- [T1055 ] Process Injection – Not mentioned in article.
Indicators of Compromise
- [Domains ] RPC and blockchain API endpoints used for dead-drop retrieval – polygon.publicnode.com, eth-mainnet.nodereal.io, and other RPC providers
- [URLs ] Example C2 and blockchain endpoints observed in one-liners – http://83.97.20[.]150, http://137.184.198[.]91/R2dIXAJpSXwxP
- [Contract Addresses ] Smart contracts queried for dead-drop values – 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, 0xab09c722546fd5e6775affaf989aac3363ac7919, and 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9
- [Function Selectors ] Contract function selectors used in dead-drop calls – 0x3bc5de30, 0x02d1e413
- [File Names / Binaries ] Dropped or referenced malware artifacts – bun binary, mini Shai-Hulud
- [Domains ] Resolved or referenced C2 domains – njzlopghznkamkl.cfd, photo-*.cfd
Read more: https://www.netskope.com/blog/blockchain-dead-drop-resolvers-explained