Executive Summary
In April 2026, a sophisticated malware campaign involving the 'Ethereum Loader' was identified, characterized by its use of the Ethereum blockchain for stealthy Command and Control (C2) communications via JSON-RPC calls. The loader specifically targets Windows environments by masquerading as a legitimate VMware component (rtmext.dll) using forged metadata and version information to bypass security whitelisting.
The attack chain involves a modular framework where the primary loader drops secondary payloads like payload.dll and managed.dll. It employs several advanced evasion techniques, including XOR-encrypted string obfuscation (key 0x37), randomized timing loops to bypass sandboxes, and API wrapping to evade EDR hooks. The malware ensures persistence through both Windows Registry 'Run' keys and scheduled tasks executing with elevated privileges.
This campaign represents a significant evolution in tradecraft due to its 'bulletproof' infrastructure and use of decentralized blockchain protocols for C2. With detection rates as low as 1/71 in mid-2026, it poses a high risk to organizations relying on traditional signature-based or basic behavioral detections.