GHAPPIER/PolinRider Ethereum Blockchain Dead-Drop C2 Resolution

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects HTTP POST requests directed at etherscan.io containing 'eth_call' in the request body. This pattern is indicative of the GHAPPIER / PolinRider malware family utilizing the Ethereum blockchain's public JSON-RPC interface as a dead-drop resolver for command-and-control communication.