Hackers linked to Iran and North Korea are increasingly using public blockchains to hide malware-related code and information, with the number of observed cases rising by about 420% over the past year, according to the report.
The technique involves storing commands, addresses, or other data required by malware inside blockchain transactions or smart contracts. Because information recorded on a public blockchain is difficult to remove, malware can continue retrieving its instructions even if the attackers’ websites or servers are blocked or taken offline.
The approach effectively turns blockchain infrastructure into a persistent storage layer for malicious operations. Rather than relying entirely on conventional command-and-control servers, attackers can embed critical information in an environment that is distributed and resistant to conventional takedown efforts.
One investigation cited in the report identified traces linked to Iran’s Ministry of Intelligence in the use of the Bitcoin blockchain. In that case, information needed by the malware to connect to the attackers’ infrastructure had been stored on the Bitcoin blockchain.
The sharp increase in blockchain-based malware storage highlights a growing security challenge for public networks. As more attackers experiment with permanent on-chain data, security researchers and blockchain infrastructure operators may increasingly focus on detecting and mitigating malicious content without disrupting legitimate blockchain activity.
