Outbound Ethereum JSON-RPC query used as C2 dead-drop resolver

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.