GuidePoint Security recently documented a sophisticated malware campaign that uses smart contracts on the Polygon blockchain to maintain command-and-control infrastructure. The technique, called EtherHiding, stores the attacker’s current C2 server address inside a blockchain smart contract instead of hardcoding it into the malware. When defenders block one C2 domain, the attacker updates the smart contract for a fraction of a cent, and every infected machine automatically follows the new address on its next check-in.
It’s clever infrastructure work — permanent, distributed, and resistant to takedowns. But it only matters if the malware successfully lands on the victim’s machine in the first place.
The Attack Chain Requires Multiple File Write Operations
The campaign starts with compromised legitimate business websites. When a victim visits via Google or Bing, malicious JavaScript displays a fake CAPTCHA overlay. The victim is tricked into running a PowerShell command (Windows+R, Ctrl+V, Enter) that downloads and executes a dropper script.
That dropper contacts a staging server and writes two PowerShell scripts to disk:
- A C2 agent that queries the Polygon blockchain smart contract to retrieve the current C2 server address
- A persistence mechanism that writes a RegistryKey so the malware survives reboot
Later stages write additional payloads to disk: a repackaged screen recorder, a fake browser extension operating as a real-time banking trojan targeting 479 financial and cryptocurrency domains.
Every one of these steps requires writing files to the Windows file system. The dropper writes scripts. The C2 agent writes itself to disk. The persistence mechanism writes registry files or startup scripts. The secondary payloads write executables or DLLs.
FileSure Defend Blocks the Payload Before It Lands
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file operations before they complete. A rule blocking executable and script file writes from browser processes prevents the initial dropper from landing on disk.
Here’s a specific rule configuration that would have stopped this campaign:
File name filter: *.exe;*.dll;*.ps1;*.bat;*.cmd;*.vbs;*.js
Program name filter: \msedge.exe;\chrome.exe;\firefox.exe;\iexplore.exe
Operations: Write, Create
Drive type: Hard drives, Workstations
Result: Block
When the victim runs the PowerShell command delivered by the fake CAPTCHA, the browser process attempts to write the dropper script to disk. FileSure intercepts that write operation at the kernel level and blocks it. The dropper never lands. The C2 agent is never written. The persistence mechanism is never created. The banking trojan never touches the file system.
The blockchain-based C2 infrastructure becomes irrelevant because there’s no malware on the machine to query it.
The Earliest Intervention Wins
Defenders often focus on detecting malicious behavior after execution — monitoring network traffic for C2 communication, watching for suspicious registry modifications, analyzing process injection. This campaign demonstrates why that approach struggles: the attacker built infrastructure specifically designed to evade those detections.
FileSure Defend intervenes earlier in the attack chain. Controlling file operations at the kernel level means the attack is stopped at the delivery stage, before any malicious code executes. No signatures required, no behavioral analysis needed — just a simple rule that says browsers don’t get to write executable files to disk.
The GuidePoint report notes that as of their writing, three of the four C2 domains remain active and several compromised sites are still serving the malicious script to visitors. Organizations with kernel-level file operation controls in place are protected regardless of how many C2 domains the attacker rotates through or how many legitimate websites get compromised.
Start a Free Trial
FileSure Defend runs on Windows systems and integrates with your existing RMM platform. Install it, enable the pre-configured rules, and you’re protected against payload delivery via browsers, email clients, and other common vectors. Start your free 21-day trial at bystorm.com.
Source: EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight
Category: Ransomware
Tags: etherhiding, blockchain malware, polygon blockchain, fakecaptcha, clickfix, powershell dropper, kernel filter driver, file system security
