Blockchain smart-contract C2 discovery is unique to ChainScript

Assessment

ChainScript's most distinctive feature is that it reads a Polygon smart contract to locate its active WebSocket C2 infrastructure, an EtherHiding-style technique that separates C2 discovery from the implant and resists takedown. But it is not novel to ChainScript: Blackpoint's own analysis states the malware uses this approach 'like many malware families observed in recent months,' and EtherHiding — abusing blockchain smart contracts as a resilient dead-drop resolver for C2 — has been an established and increasingly common technique since it was first popularised in 2023. A reader who takes coverage of ChainScript's Polygon-based C2 to mean the RAT pioneered blockchain C2 would be crediting it with a technique it merely adopted from a broader trend the researchers explicitly flag.