Graphalgo RAT blockchain dead-drop C2 via setCPubKey/serviceData calls

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•5

Detects specific JSON-RPC calls indicating C2 communication associated with the Graphalgo RAT. The rule identifies calls to the 'eth_call' method referencing specific function names like 'setCPubKey', 'serviceData', or a hardcoded Arbitrum Sepolia contract address used as a blockchain dead-drop mechanism.