DEV#POPPER RAT Blockchain C2 Staging via Trongrid/BSC/Aptos APIs

Emiliano Mema@Nosalva

•updated Aug 28, 2026•1•0•4

Detects developer tooling processes such as Node.js, npm, and yarn—or processes spawned by code editors like VS Code and Cursor—establishing network connections to specific blockchain API endpoints (Tron, Binance Smart Chain, Aptos). This behavior is associated with the DEV#POPPER RAT, which utilizes these blockchain transaction channels to stage encrypted payloads and retrieve configuration keys.