Security researchers have uncovered a new remote access trojan (RAT) that employs a decentralized and resilient technique for communicating with its operators: hiding its command-and-control (C2) server address within a smart contract on a public blockchain.
Dubbed "ChainScript," the malware represents a practical application of a theorized adversary tactic. By leveraging the immutable and distributed nature of the Polygon blockchain, its creators aim to make taking down their control infrastructure significantly more difficult. This approach grants attackers both persistence and agility, as they can update the C2 address by simply modifying the smart contract, all while the core infrastructure remains resistant to traditional takedown efforts.
According to an analysis published by Security Affairs, the threat was uncovered by Blackpoint's Adversary Pursuit Group during their investigation into a "ClickFix" campaign distributing unknown malware. The code was identified as a previously undocumented Node.js RAT. Its use of Node.js is a deliberate choice, allowing the malicious process to blend in with legitimate development tooling on a system, complicating detection based on process behavior alone.
The core innovation lies in how ChainScript resolves its C2. Instead of having a hardcoded IP address or domain name—which can be seized or sinkholed—the malware queries a specific Polygon smart contract. This contract acts as a decentralized phone book; it holds the current C2 address, and the malware reads this data directly from the blockchain to know where to connect. For an attacker, rotating command servers becomes as simple as pushing an update to the contract, a move that propagates across the decentralized network without a single point of failure.
The development carries broad implications for IT and security teams, particularly in regions with significant software development and fintech activity. While the specific campaign may not be locally targeted, the technique is of broad interest. Defenders are advised to:
- Monitor for anomalous blockchain queries: Endpoint detection and response (EDR) solutions should be configured to flag or investigate unusual processes, particularly Node.js runtimes, that initiate network connections to known blockchain network nodes or APIs.
- Prioritize process scrutiny: Do not assume non-binary, script-based processes are benign. Analyze the behavior and parent-child relationships of unexpected Node.js instances.
- Focus on behavior over signatures: Given the malware's ability to blend in, detection will likely rely on identifying its malicious actions—such as reconnaissance, data exfiltration, or unauthorized connections—rather than a static malware signature.
The ChainScript discovery highlights how threat actors continually innovate to enhance operational security. As blockchain technology matures, its misuse as a covert communication layer for malware infrastructure is a likely evolution that the cybersecurity community must anticipate and defend against.
安全研究人員發現了一種新的遠端存取木馬，該木馬採用一種去中心化且具韌性的技術與操作者通訊：將其指揮與控制（C2）伺服器地址隱藏在公共區塊鏈的智能合約中。
這種被稱為「ChainScript」的惡意軟件，代表了理論上的對手戰術的實際應用。通過利用 Polygon 區塊鏈的不可變及分布式特性，其創建者旨在使其控制基礎設施的取締變得極為困難。這種方法賦予了攻擊者持久性與敏捷性，因為他們只需修改智能合約即可更新 C2 地址，而核心基礎設施則能抵禦傳統的取締行動。
根據 Security Affairs 發布的分析報告，Blackpoint 的 Adversary Pursuit 小組在調查一個分發未知惡意軟件的「ClickFix」活動時發現了這個威脅。該代碼被識別為一個先前未有記載的 Node.js 遠端存取木馬。選擇使用 Node.js 是刻意之舉，使得惡意進程能與系統上的合法開發工具混雜，從而僅憑進程行為分析難以偵測。
其核心創新在於 ChainScript 如何解析其 C2。與使用硬編碼的 IP 地址或域名（可能被查封或劫持）不同，該惡意軟件查詢特定的 Polygon 智能合約。該合約充當去中心化的電話簿；它保存當前的 C2 地址，惡意軟件直接從區塊鏈讀取此數據以知道連接何處。對攻擊者而言，輪換指揮伺服器變得如同向合約推送更新一樣簡單，此操作在去中心化網絡中傳播，無單點故障。
此發展對 IT 和安全團隊具有廣泛影響，特別是在軟件開發和金融科技活動活躍的地區。雖然具體的活動可能並非針對本地，但該技術受到廣泛關注。建議防禦者：
- 監控異常的區塊鏈查詢： 端點偵測與回應（EDR）解決方案應配置為標記或調查異常進程，特別是那些發起與已知區塊鏈網絡節點或 API 網絡連接的 Node.js 運行時環境。
- 優先審查進程： 不要假設非二進制、基於腳本的進程是良性的。分析意外 Node.js 實例的行為及其父子關係。
- 關注行為而非特徵： 鑒於該惡意軟件的混雜能力，偵測可能依賴於識別其惡意行動——如偵察、數據竊取或未授權連接——而非靜態的惡意軟件特徵。
ChainScript 的發現凸顯了威脅參與者如何持續創新以增強操作安全性。隨著區塊鏈技術的成熟，其被濫用為惡意軟件基礎設施的隱蔽通訊層是可能的演變，網絡安全界必須預期並防禦此點。