Blockchain activity requiring investigation
Description
AlphaSOC detected network traffic to a known public blockchain RPC or API service. While these services have legitimate uses, malware can use them to query smart contracts for live command-and-control (C2) information or to retrieve payload data. For example, the EtherHiding technique stores C2 addresses or payloads inside smart contracts, giving threat actors a resilient, decentralized channel hosted on legitimate blockchain providers.
Impact
This activity may indicate that a compromised system is communicating with attacker-controlled infrastructure through a legitimate third-party service. Because the provider itself is often trusted and widely used, this technique can make malicious C2 traffic harder to identify and block.
Severity
| Severity | Condition |
|---|---|
Medium | Traffic to a known public blockchain RPC or API service |
Investigation and Remediation
Identify the host, user, process, and application responsible for the traffic. Determine whether the blockchain service is expected for that system or workload. Review nearby DNS, HTTP, and network activity for additional signs of compromise, such as unusual downloads, persistence, or connections to suspicious destinations. If the activity is unauthorized or malicious, isolate the host, terminate the responsible process, and conduct incident response and forensic analysis.
Known False Positives
- Authorized blockchain applications, wallets, or development workloads
- Asset-monitoring, payment, or other services that legitimately use blockchain APIs