Blockchain C2 Infrastructure

Blockchain C2 uses public blockchains as takedown-resistant command-and-control configuration stores: malware or victim-facing apps read C2 addresses, payload URLs, or leak-site content out of smart-contract storage (or transaction calldata) via read-only eth_call requests to public RPC endpoints. The operator rotates infrastructure by sending a cheap write transaction — no domain registration, no DNS, no server to seize. It is the on-chain realization of the classic dead-drop resolver pattern (MITRE ATT&CK T1102.001): the implant never hardcodes its C2, it reads a public bulletin board only the operator can edit. ¹

Why it resists takedown

• Immutability — contract storage can’t be sinkholed, seized, or deleted; the pointer layer survives any action against domains or hosting.
• Cheap rotation — updating a stored C2 address is a single transaction costing cents; the victim-facing artifact (HTML page, loader script) never changes.
• Stealth reads — eth_call is read-only: no transaction, no gas, no on-chain trail of the victim’s lookup; traffic blends with ordinary Web3 JSON-RPC.

Retrieving C2 from the blockchain (“EtherHiding” on BNB Smart Chain and Ethereum, later adopted by North Korean state actors) is a documented common tactic for cybercriminals — but it remained rare in the ransomware world until DeadLock (2026). ²

Case study: DeadLock ransomware (Microsoft, 2026-08-10)

DeadLock is a Rust-based double-extortion operation first seen July 2025; by July 2026 its leak blog listed 80+ organizations (over half in Europe), deployed by multiple groups including a Lynx/INC-ransomware affiliate. Its distinctive feature is a self-contained RECOVERY_CHAT.<UID>.html app — E2EE chat, paginated leak blog, and file browser with no traditional backend: ³

• Polygon as config store. Two contracts serve as censorship-resistant infrastructure: a chat-proxy contract (0x8EF7c3e5…, selector 0x933a9ce8) holding the current proxy URL, and a blog contract (0x75798450…, selector 0xd4070542) serving leak posts with pagination. The page cycles six public Polygon RPC endpoints for redundancy.
• Session network for comms. Victim↔operator chat rides Session’s onion-routed swarm network; the victim’s Session identity is deterministically derived from their sign-in credentials (Ed25519 → Curve25519), so no account registration exists and forgotten credentials mean an unrecoverable identity. The blockchain-supplied proxy relays between browser and Session swarms.
• Wasabi cloud hosting for exfiltrated files; ransom demanded in Bitcoin or Monero.

The encryptor itself is disciplined tradecraft: per-file XChaCha20 keys wrapped with Curve25519, intermittent 512-byte-block encryption for large files (fast but irrecoverable), resource throttling (≤29% RAM, ≤70% CPU) so victims can keep working, CIS/Middle-East language geofencing with immediate self-delete, backup deletion, event- log clearing, and ransom notes + wallpaper. ⁴

The catch: decentralization has a centralized edge

Microsoft’s own caveat is the durable lesson: DeadLock’s chat still requires the custom proxy, the public Polygon RPC endpoints must stay reachable, and Wasabi files can be removed — “resistance to disruptions isn’t absolute.” The immutable on-chain pointer is always read through chokepoints (RPC gateways, proxies, hosting) that defenders can block, monitor, or pressure. Detection guidance follows from that: alert on outbound JSON-RPC / eth_call patterns to public chain RPC endpoints, and pin blocklists to the stable artifact — the contract addresses — rather than the rotating C2 values. Endpoint-side, Microsoft recommends EDR in block mode, tamper protection, Controlled Folder Access, and ASR rules blocking untrusted executables and PsExec/WMI lateral movement. ^{5 6}

Connections

• web3-identity — the same substrate (smart contracts, Curve25519-family keys, deterministic derivation) turned to offense; DeadLock’s credential→Session-identity derivation is HD-wallet logic in miniature.
• farcaster-protocol — another attempt to get resilience from decentralization; both end up leaning on centralized access layers in practice.
• dulles-73-rules-of-spycraft — the dead drop is the oldest version of this idea: a public, durable location only one party writes and others read; the blockchain just makes the drop unburnable.
• wmi-remote-service-execution — the lateral-movement vector DeadLock’s recommended ASR rules target.
• private-sector-hack-back — the 2026-08-12 NSPM deputizes vetted private firms to disrupt exactly this class of takedown-resistant criminal infrastructure.

Sources

• 2026
• 2026

Footnotes

1. 2026 ↩

2. 2026 ↩

3. 2026 ↩

4. 2026 ↩

5. 2026 ↩

6. 2026 ↩