Skip to content

Blockchain-based C2

Named by 2 kept items in this workspace.

Search every workspace for Blockchain-based C2. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader
    article2026-09-22

    PolinRider used Ethereum blockchain empty transactions, writing configuration into the twenty bytes of a recipient address, creating a C2 channel with no domain to suspend, no host to seize, and no account to disable.

  • NPM Isn't Prepared For North Korean PolinRider Attack
    writeup2026-08-25

    NullReceiver loader queries public Ethereum RPC endpoints (1rpc.io, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io, eth.blockscout.com/api) as part of its C2 mechanism, then connects to attacker-resolved IPs at paths /0x/cls and /0x/ls.

All techniques in this workspace.