30
30
30
The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
Unit 42 analyzes the Aeternum botnet loader, which uses Polygon blockchain smart contracts for resilient decentralized C2 and payload execution.
Palo Alto Unit 42 published a technical analysis of Aeternum, a botnet loader that leverages Polygon blockchain smart contracts as its command-and-control infrastructure. The decentralized C2 design makes takedown difficult, giving the threat a persistent, 'permanent' communication channel for payload delivery and execution. The analysis covers the smart contract mechanics and communication protocol used by the operation.
55
30
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.
45
ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.
ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.
55
42
55
60
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler discovered SloppyRAT, a ClickFix-delivered RAT that gives ransomware operators reconnaissance, remote execution, and SOCKS proxy pivoting for lateral movement.
Zscaler identified SloppyRAT in June 2026, linked to a ransomware-related threat actor. The infection chain starts with a ClickFix lure abusing finger.exe over TCP port 79, then uses curl.exe, IronPython, CastleLoader, and CastleRAT before reflectively loading SloppyRAT as a DLL in memory. The RAT supports HTTPS command-and-control, system inventory, file operations, Defender tampering, and a reverse SOCKS proxy, with evasion features including runtime code encryption, indirect syscalls, certificate pinning, and a possible EtherHiding blockchain fallback. Its persistence code is buggy and the malware appears under development, but the pre-encryption foothold gives defenders a window to stop intrusions.
52
Fake Claude Opus 5 app delivers malware and wipes its own tracks
A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.
Morphisec identified a malicious GitHub repository, Claude-Opus-5-Free-Desktop, impersonating Anthropic to distribute a roughly 101 MB download that launches RevStealer, a Windows information-stealing malware. The malware targets browser credentials, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN, messaging, game launcher and streaming accounts, streaming stolen data to its server before deleting itself. It evades analysis with ten sandbox and VM checks, indirect system calls, Windows Defender exclusions, a fake verification window, and a Polygon blockchain smart contract fallback for C2. Only 1 of 66 antivirus engines flagged the sample at check time.
55
30
30
42
42
55
30
60