Blockchain-assisted cyberattacks surge fivefold, driven by state actors and criminal groups

Surge in Blockchain-Assisted Cyberattacks

Blockchain-assisted cyberattacks have seen a more than fivefold increase since last year. This surge is largely attributed to nation-state actors from North Korea and Iran, as well as Russian-speaking criminal organizations. The technique, termed Blockchain Dead Drops (BDD), involves storing malicious payloads or command-and-control data on public, censorship-resistant blockchains.

Enhanced Durability of Cyber Campaigns

The BDD technique provides cyberattack campaigns with increased durability. By leveraging the public, immutable, and globally replicated nature of blockchain data, attackers make their infrastructure highly resistant to disruption. This resilience prevents takedowns through domain seizures, repository removals, or hosting disruptions, allowing threat actors to maintain command and control without interruption.

Lowered Barrier to Entry for Cybercrime

The widespread availability of Chinese open-source AI tools has significantly reduced the technical expertise required for cybercrime. This accessibility enables less-experienced attackers to launch complex cyberattacks, contributing to the reported 440% rise in BDD attacks. The tools allow a broader range of actors to utilize sophisticated attack methods.

How Blockchain Dead Drops Work

BDD typically involves storing either malware payloads or dynamic command-and-control (C2) configuration pointers on the blockchain. In C2 setups, the on-chain data directs compromised devices to the attacker's current infrastructure by providing domains, IP addresses, or other pointers. Malware on the victim's machine retrieves and decodes this data to connect to an off-chain C2 server for subsequent commands and malicious activity.

Payload Delivery and Off-Chain Execution

In payload-delivery setups, attackers store malicious code or encrypted payload components directly on-chain for victim machines to retrieve and execute. Once the necessary data is acquired, the operation moves off-chain, where the attacker executes the actual compromise. This can involve deploying infostealers targeting crypto wallets and credentials, or remote access trojans for persistent system control.