Lazarus InvisibleFerret Blockchain Dead-Drop C2 Resolution via TronGrid/Aptos from python/node

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.