Botnet Stores for Aeternum C2 Polygon Blockchain Encrypted Commands to Avoid Takedown

Aeternum C2, a new botnet loader that employs a blockchain-based command-and-control (C2) infrastructure to make it resistant to takedown attempts, has been revealed by cybersecurity researchers This article explores c2 new botnet. . "Decentralized applications, such as Polymarket, the biggest prediction market in the world, make extensive use of this network.

Because of this strategy, Aeternum's C2 infrastructure is essentially permanent and impervious to conventional takedown techniques. Botnets using blockchain for C2 have been discovered previously. Google claimed to have taken action in 2021 to stop the Glupteba botnet, which uses the Bitcoin blockchain as a backup C2 mechanism to retrieve the real C2 server address.

The first information about Aeternum C2 surfaced in December 2025 when Outpost24's KrakenLabs disclosed that a threat actor going by the name of LenAI was selling the malware on underground forums for $200, which gives users access to a panel and a configured build. The revelation coincides with Infrawatch's publication of information about an underground service that installs specialized laptop hardware in American homes in order to co-opt the devices into a residential proxy network called DSLRoot, which uses them to reroute malicious traffic. The hardware is intended to run a Delphi-based program called DSLPylon, which has the ability to remotely control Android devices and home networking equipment through an Android Debug Bridge (ADB) integration, as well as enumerate supported modems on the network.

"Attribution analysis identifies the operator as a Belarusian national with residential presence in Minsk and Moscow," according to Infrawatch. It is estimated that DSLRoot operates about 300 hardware devices in more than 20 U.S. states."

The service was advertised on BlackHatWorld by a user using the alias GlobalSolutions, claiming to provide physical residential ADSL proxies for sale for $190 per month for unrestricted access. The operator has been identified as Andrei Holas (also known as Andre Holas and Andrei Golas).