Blockchain-assisted cyberattacks surge fivefold, driven by Iranian and North Korean state actors, Russia-linked groups

retained text

Blockchain-assisted cyberattacks surge fivefold, driven by Iranian and North Korean state actors, Russia-linked groups — open-weight LLMs are linked to an increase in attacks
Blockchain dead drops technique stores malicious payloads on blockchains
Blockchain-assisted cyberattacks have risen more than fivefold since last year, driven largely by North Korean and Iranian nation-state actors and Russian-speaking criminal groups, according to a report by blockchain data and intelligence platform Chainalysis. Rather than storing malicious payloads on servers that are susceptible to disruption, the attackers store them on public, censorship-immune blockchains. The technique, named Blockchain Dead Drops (BDD), stores payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand.
What makes BDD particularly dangerous is that it gives cyberattack campaigns unprecedented durability. Because blockchain data is public, immutable, and replicated worldwide, takedowns become immensely difficult. Threat actors can use this resilient infrastructure for command and control without worrying about losing the layer to domain seizures, repository removals, hosting takedowns, and additional disruptions.
The report notes that the widespread availability of Chinese open-source AI tools has significantly lowered the technical barrier to entry for cybercrime. Meaning that less-experienced attackers can now launch complex cyberattacks, which is linked to a reported 440% rise in BDD attacks.
Understanding the Blockchain Dead Drops technique
While blockchain dead drops vary across cyberattack campaigns, attackers typically store either malware payloads or dynamic command-and-control (C2) configuration pointers on the blockchain itself. In C2 setups, the on-chain data does not carry out the attack. Instead, it holds configuration information, such as domains, IP addresses, or other pointers, that direct compromised devices to the attacker’s current infrastructure. Malware on the victim's machine retrieves and decodes this data, which then connects to the real C2 server off-chain, where subsequent commands and malicious activity take place.
In payload-delivery setups, attackers store malicious code or encrypted payload components on-chain for victim machines to retrieve and execute locally. In both cases, once the malware has what it needs, the operation moves off-chain, where the attacker executes the actual compromise, which, depending on the campaign, can mean infostealers targeting crypto wallets and credentials, or remote access trojans that give attackers persistent control over systems.
Chainalysis identified several techniques threat actors use to hide malware on-chain, primarily using transaction-based storage and contract-based storage. In transaction-based storage, attackers publish C2 configurations, payload references, or infrastructure pointers inside blockchain transactions for malware to retrieve later, embedding the data in fields such as memos or calldata. This can occur on a single chain or spread across several blockchains.
On the other hand, contract-based storage uses smart contracts as resilient storage for the same kinds of data, with the contract's state holding the current C2 pointer. This is the model behind EtherHiding, where malware queries the contract for up-to-date information, while the attackers' visible on-chain activity is typically limited to deploying and periodically updating the contract.
Beyond these two approaches, threat actors continue to develop new, less detectable ways to hide malicious data on-chain. One such technique involves “phantom wallets”, blockchain addresses that have no corresponding private key. Instead of placing their C2 server's IP address in a transaction or smart contract, attackers encode it directly into the bytes of the wallet address itself, then send zero-value transactions to that address. Malware on the victim's machine is programmed to decode the IP address from the phantom wallet and connect to the attacker's C2 server.
Nation-state actors are driving a surge in attacks
The BDD technique has been around for over a decade. One of the earliest instances was in 2013, when a Necurs botnet variant stored its C2 domain info on Namecoin, a Bitcoin fork. Then, in 2019, attackers encoded C2 IP addresses for banking malware into Bitcoin transactions. That same year, Glupteba crypto-mining botnet stored malicious info in Bitcoin’s OP_RETURN field.
EtherHiding, the implementation of BDD on EVM chains, began in Mid-2023, following Cloudflare crackdowns that blocked their infostealer malware distribution servers. The ClearFake malware crew moved malicious code into smart contracts on the BNB Smart Chain. This allowed the campaign to keep going, as the chain couldn't be taken offline. Within days, other groups began testing ways to replicate the move, and by late December 2023, the Smargaft DDoS botnet was also using smart contract-based C2 on BSC.
State-level actors entered the scene in 2024, when Iranian actors linked to the country's Ministry of Intelligence first embedded C2 data in Bitcoin transactions. By 2025, North Korean actors began using EtherHiding in fake job interview campaigns. Since then, daily malicious blockchain writes have increased from 2.06 to 11.1, a 440% increase that Chainalysis attributes to AI. Before the launch of powerful open-weight Chinese LLMs — which can be uncensored through a process known as abliteration — building effective BDDs required substantial cybersecurity and crypto experience. Now, far less experienced threat actors can deploy BDDs easily.
Tracking BDD activity across five major blockchains and over a dozen named malware strains, Chainalysis reports that by Q2 2026, “state-actor-linked groups were responsible for roughly two-thirds of new BDD activity each quarter, and half of total BDD activity,” despite only just entering the scene in mid-2024. The campaigns are being perpetrated by Iranian, North Korean, and Russian-speaking operators.
Circumventing blockchain dead drops
A seemingly obvious fix, blocking blockchain traffic, is out of the question. For example, cutting off Ethereum access would mean blocking every public RPC endpoint that providers such as Cloudflare and Alchemy run. This would also impact legitimate wallets and DeFi services. Even then, the attackers could just go back to running their own nodes off-chain. Similarly, restricting what can be written to a public blockchain at the protocol level is impractical, as the fundamental changes this would require would likely cause more harm than the malware.
This leaves detection, identifying the attackers, and disrupting the off-chain parts of the operation as the only viable options. In this case, the same blockchain properties that make BDD attractive to attackers work against them. Every time an operator rotates infrastructure by publishing a new transaction or updating a contract, the change is permanently recorded and timestamped on a public ledger. By tracing operator wallets, resolver contracts, funding sources, and update histories, investigators can link seemingly unrelated campaigns back to the same actors.
For organizations, one practical early-warning signal is outbound JSON-RPC traffic to public blockchain endpoints, particularly from machines with no legitimate reason to query a blockchain. A workstation or build server reading data from a smart contract should probably sound some warning bells. The technique also maps to an existing MITRE ATT&CK entry, T1102.001 (Web Service: Dead Drop Resolver), giving security teams an established framework for building detections.
In the case of individuals, it's important to note that BDD comes into play only after something malicious is already running on a device. The blockchain tells the malware where to go next, but it doesn't get the malware onto the machine in the first place. North Korea's fake job interview campaigns, for example, still require developers to first download and run malicious code. Therefore, being wary of unsolicited outreach — especially when it involves coding tests that require running unfamiliar repositories — remains the first and most effective line of defense.
Etiido Uko is a news contributor for Tom's Hardware covering the latest updates in big tech and the PC industry. He is a mechanical engineer and senior technical writer with over nine years of experience in documentation and reporting. He is deeply passionate about all things engineering and technology, and is an expert in gadgets, manufacturing, robotics, automotive, and aerospace.

document fetched 2026-09-30 02:59 · canonical https://tomshardware.com/tech-industry/cyber-security/blockchain-assisted-cyberattacks-surge-fivefold-driven-by-iranian-and-north-korean-state-actors-russia-linked-groups-open-weight-llms-are-linked-to-an-increase-in-attacks