Malware Uses Ethereum Contract for C2

Attackers embedded a backdoor in widely installed WordPress plugins and made the malware’s command‑and‑control (C2) domain resolvable via an on‑chain pointer inside an Ethereum smart contract. Because the smart contract can be updated to point to new domains, traditional domain‑takedown responses are ineffective and incident responders must treat blockchains as persistent infrastructure in malware investigations. — Shows how blockchain features can be repurposed to evade existing cyber‑defense practices and highlights a governance gap in marketplace ownership transfers that enables large‑scale web compromises.