In February 2026, Qrator Labs documented Aeternum C2: a botnet loader that stores its command-and-control instructions in Polygon blockchain smart contracts. It was the first commercial blockchain botnet we identified on any cybercrime network. One month later, and we have found a second one called Void Botnet.
Void Botnet uses Ethereum instead of Polygon, is written in Rust rather than C++, and is sold by a different malware developer operating under the handle TheVoidStl. The architecture is otherwise the same: commands written to smart contracts, bots polling public RPC endpoints, and C2 infrastructure that is hard to take down.
The listing, panel, and demonstration screenshots that follow are reproduced from a Russian-language cybercrime network where the seller advertises Void Botnet. As a result, some interface labels appear in Russian throughout the screenshots.
Based on the seller's documentation and panel screenshots, Void Botnet is a Rust-native loader with two command-and-control modes in the same binary. The first mode routes commands through Ethereum smart contracts: the operator writes instructions to a contract, and infected machines check it at regular intervals, picking up new tasks within three to five minutes.
The second mode connects machines directly to the operator's web panel, with tasks completing in under thirty seconds. The operator switches between them at any time by updating the contract. The choice is a tradeoff between speed and resilience: the direct mode is faster, the blockchain-based C2 is harder to take down.
The panel shows each machine enrolled in the botnet together with its location, operating system, running antivirus product, and whether it has administrator access. Tasks can be pushed to individual machines or the entire fleet at once, with the option to filter by country when targeting a specific region.
The C2 mechanism works on the same principle we documented in Aeternum C2: commands written to smart contracts, bots polling public RPC endpoints, no server to seize, and no domain to suspend. Void Botnet uses Ethereum rather than Polygon, but the takedown problem is identical.
The panel gives an operator a full toolkit for post-compromise work. Payloads can be delivered as executables, DLLs, MSI packages, or PowerShell scripts. A dedicated in-memory execution mode loads binaries directly into process memory without writing them to disk, bypassing defenses that rely on file-based detection.
For hands-on access, reverse shell and PowerShell tasks open interactive sessions on compromised machines while the panel continues processing other tasks in the background. SelfDelete and SelfUpdate allow the operator to remove or update the agent on demand.
The panel records the outcome of each task for each infected machine, so an operator can see at a glance which bots responded and which did not. In the seller's demonstration, an in-memory execution task sent to twenty-three machines completed successfully on fourteen with two failures; a payload delivery task succeeded on seventeen. During our analysis, live shell sessions were open on machines in the developer's demonstration environment, with terminal output visible.
Aeternum and Void Botnet came from different developers, used different blockchains, and appeared only weeks apart, with no apparent connection to each other. The emergence of two independently developed blockchain-based botnets within such a short period suggests that blockchain C2 infrastructure is starting to become more popular among cybercriminals.
The practical problem here is that there is nothing to seize: a botnet using blockchain-based C2 doesn’t rely on any particular server, a domain registrar, or a single point that a takedown effort can reach. As a result, these botnets run longer, and the attacks they enable, including DDoS campaigns, credential stuffing, and proxy-as-a-service operations, are much harder to stop at the source. This makes proactive defensive measures, such as anti-bot protection and DDoS mitigation, increasingly important.
The analyzed Void botnet demonstrates behavior associated with multiple MITRE ATT&CK techniques:
The following indicators and operational characteristics were associated with the analyzed Void botnet infrastructure:
Share your experience and expectations regarding DDoS protection. Your answers will help us tailor solutions to meet your cybersecurity needs.
Tell us about your company’s infrastructure and critical systems. This will help us understand the scope of protection you require.
Help us learn about how decisions are made in your company. This information will guide us in offering the most relevant solutions.
Let us know what drives your choices when it comes to DDoS protection. Your input will help us focus on what matters most to you.
