Blockchain Dead Drop C2 Retrieval via Developer Runtimes (Infostealer)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.