Exploring Threats Leveraging Blockchains

The talk starts from the problem that attackers are using public blockchains as command-and-control infrastructure, which is hard to take down because the chain is decentralised and the traffic looks like ordinary blockchain use. The speaker, a malware analysis lead who came to this topic only recently, gives a beginner-friendly primer. He covers full nodes, RPC endpoints reached over HTTPS or WebSockets, and smart contracts, which can be read for free but cost a small fee to write to. Because updating stored data is cheap, an operator can swap out a server address without touching the malware.

The middle of the talk walks through several cases. One malware family stored PowerShell commands in a contract. A North Korean-linked campaign kept obfuscated JavaScript as its next stage. Another sample used a contract to hold a C2 address, with write access tied to a specific wallet, which blocked a would-be hijacker. Other cases used decentralised storage networks, IPFS and NKN, the latter giving a reverse shell. Each new chain meant learning its protocol and bytecode again, and some chains have almost no analysis tools.

The closing section covers hunting. Analysts can search for RPC endpoint strings in sandbox or file repositories, watch transactions for encoded payloads or URLs, and use block explorers, transaction simulators, decompilers and graph tools to pivot from wallets to contracts. Victims are largely invisible because infected machines do not write transactions. Blocking well-known RPC endpoints may also disrupt legitimate business use.