Sepolia Testnet C2 Polling via Alchemy/Infura RPC Endpoints

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects network traffic associated with the NPM Btree malware campaign, specifically identifying command-and-control (C2) polling activities directed toward blockchain RPC endpoints like Alchemy and Infura. The rules monitor for specific API keys, C2 smart contract addresses via 'eth_call' JSON-RPC requests, and overall traffic patterns to known malicious infrastructure.