Smart Contract Hacks Pose New Cybersecurity Risks for Blockchain Infrastructure

Cybercriminals are leveraging blockchain to store encrypted malware commands, using smart contracts as a resilient infrastructure for botnets. This method exploits the decentralized and immutable nature of blockchain, complicalling traditional takedown efforts by defenders. The use of public RPC endpoints and Ethereum-based smart contracts increases the complexity of detecting and mitigating these threats.

Cybercriminals are increasingly using smart contracts on blockchains like Polygon and Ethereum to store encrypted command-and-control (C2) instructions for malware. This approach leverages the decentralized and immutable nature of blockchain to create infrastructure that is difficult to shut down. Instead of traditional centralized C2 servers, malware operators write commands to smart contracts, which are then accessed by bots. These contracts are encrypted and can only be modified by the wallet owner, offering a high level of control and persistence.

The malicious smart contracts are often embedded in open-source libraries, making them harder to detect as part of a supply-chain attack. This evolution in malware tactics introduces new challenges for cybersecurity teams, who must now monitor blockchain activity for suspicious patterns. The decentralized and distributed nature of the blockchain makes it hard to determine who is operating the smart contracts, adding an additional layer of complexity to threat response.

The Aeternum C2 botnet is an example of this approach, where operators use smart contracts on the Polygon network to manage multiple payloads. The botnet's design includes anti-analysis features such as virtual environment detection and Kleenscan integration to avoid detection. Despite the complexity, operational costs remain low, with as little as $1 in MATIC needed for 100-150 command transactions.

Smart contract implementation poses additional challenges for blockchain security, including the need for improved standardization and more rigorous auditing processes. These issues are critical for the development of trust and reliability in decentralized systems. Security must be embedded into every layer of blockchain app development, from smart contracts to off-chain services. Principles such as minimal trust design, layered security, and regular audits are essential for mitigating common vulnerabilities like reentrancy attacks or oracle manipulation.

How Are Hackers Using Blockchain to Evade Detection?

Hackers are embedding command-and-control instructions directly into smart contracts, leveraging blockchain's decentralized and immutable properties. This approach is particularly effective for botnets, which can persist indefinitely as long as the smart contracts remain active. The operators can update or alter the commands by interacting with the smart contracts using their wallet, bypassing the need for centralized servers that are easier to track and shut down.

The decentralized nature of the blockchain also makes it difficult for defenders to determine the origin of the malicious activity. Unlike traditional C2 infrastructure, which can be traced to a specific server or domain, smart contracts are deployed on a public network and accessed through RPC endpoints. This anonymity allows attackers to operate under the cover of decentralized infrastructure.

In some cases, attackers have even offered the full codebase of their malware for sale, with additional features available for a higher price. This commercialization of malware indicates a growing trend of using blockchain as a tool for cybercrime.

What Are the Risks and Limitations of Smart Contract-Based Cyberattacks?

The main risk of these attacks is the increased resilience they offer to malicious actors. Traditional C2 servers can be taken down, but smart contracts on blockchains are immutable and persistent. This makes it extremely difficult for defenders to eliminate the threat completely. Additionally, because the instructions are stored in smart contracts, it is harder to detect them during routine security checks or penetration testing.

However, there are limitations to this approach. Smart contract-based malware still relies on the underlying blockchain's infrastructure, which may have certain constraints. For instance, the cost of deploying and interacting with smart contracts can vary depending on the network congestion and gas fees. While this cost is relatively low compared to traditional infrastructure, it can still be a factor for large-scale operations.

Another limitation is the complexity involved in deploying and managing smart contracts. Unlike traditional malware, which can be distributed through various vectors like phishing or exploit kits, smart contract-based malware requires technical sophistication to deploy effectively. This limits the number of attackers who can successfully leverage this method.

Despite these limitations, the trend of using blockchain for cybercrime is likely to continue. As more companies adopt blockchain for legitimate use cases like supply chain management, attackers are finding new ways to exploit the same technology for malicious purposes. This highlights the need for improved security practices in both smart contract development and blockchain infrastructure monitoring.