ChainScript RAT Uses Blockchain for C2 Infrastructure Rotation

• •ChainScript RAT disguises itself as legitimate applications like Spotify.
• •The malware uses a Polygon smart contract for dynamic command-and-control server discovery.
• •ChainScript can perform extensive remote operations, including file access and cryptocurrency wallet enumeration.

Blackpoint has identified a new remote access trojan (RAT) named ChainScript, which employs ClickFix lures to infect users. The malware disguises itself as legitimate software like Spotify and uses msiexec.exe to execute a malicious installer. ChainScript operates as a Node.js RAT, utilizing a Polygon smart contract for command-and-control (C2) server discovery through a technique called EtherHiding. This allows the malware to rotate its C2 infrastructure easily, complicating detection efforts. The malware is capable of extensive remote operations, including file manipulation and cryptocurrency wallet enumeration. The attack vector primarily targets Windows systems, and the malware has been observed to establish user-level persistence. Blackpoint's Adversary Pursuit Group has been monitoring the activity and noted the malware's ability to update itself and maintain a connection to the C2 server. As of now, the threat remains active and poses a significant risk to affected users.