A newly identified botnet loader is shifting command-and-control (C2) operations onto the Polygon blockchain, eliminating the central servers that authorities and security firms have historically targeted to dismantle malicious networks. Aeternum C2, uncovered by Qrator Research Lab while monitoring cybercrime forums, replaces conventional infrastructure with smart contracts hosted on the Polygon blockchain. Instead of communicating with hardcoded IP addresses or registered domains, infected machines retrieve instructions written directly to the blockchain, where transactions are publicly recorded and cannot be removed. For years, law enforcement agencies have disrupted operations such as Emotet, TrickBot and QakBot by seizing servers or suspending domains. Aeternum appears to remove that…