The use of blockchain by attackers to transmit command and control (C2) addresses is becoming a common technique to bypass blocks. According to our telemetry, in early June the malware by HeartlessSoul has started accessing the BNB Smart Chain blockchain platform to obtain valid C2 addresses.
An obfuscated JavaScript loader accessed transaction data in the blockchain, extracted C2 addresses from it, and continued the infection chain. If the data could not be obtained, a backup C2 domain hardcoded in the loader code was used. Previously, the attackers used the Solana blockchain platform for the same scheme.
The main value of this technique for attackers is not the anonymity of the blockchain, but the ability to store and update C2 on infrastructure that is difficult to block without risking disruption to legitimate services.
The initial attack vector of this APT group has not changed: HeartlessSoul continues to distribute malicious MSI/XLL/LNK files through phishing emails and the Telegram messenger (examples of the lures are shown below). Using the Powershell command, the malicious file downloads a JavaScript loader to the victim’s system, which in turn downloads and executes additional modules from the C2 server for data theft and exfiltration.
Detection & Threat Hunting
APT groups use blockchain not only for covert transmission of C2 addresses but also for storing and delivering malicious payloads (EtherHiding technique by the UNC5342 group). Both scenarios should already be considered when building threat detection processes.
One of detection methods is monitoring accesses to legitimate blockchain services, especially the calls initiated by office applications, script interpreters, or other atypical processes. For example, in HeartlessSoul activity, calls to the following resources were noticed:
api.mainnet-beta.solana.com
bsc-rpc.publicnode.comMonitoring accesses to blockchain explorer APIs and RPC nodes of various providers (e.g., bsc-testnet-rpc.publicnode.com, ethereum-rpc.publicnode.com, ethereum-sepolia-rpc.publicnode.com, api.bscscan.com, api.testnet.solana.com, bsc.meowrpc.com, bsc-dataseed.binance.org, etc.) can help identify suspicious activity, especially when such calls are initiated by msiexec.exe, wscript.exe, cscript.exe, powershell.exe, node.exe, rundll32.exe, or office applications.
IoCs related to the latest HeartlessSoul activity:
Names of files used as lures:
акт передачи 08.07.2026.docx.lnk
сброс мавик 3.0.stl.lnk
ведомость.docx.lnk
Пояснение письменно.xll
Пояснение.xll
Пример пояснение.xll
Technical Overview Технический профиль.xllC2 domains:
healthydefinitetrunk[.]com
habitsunrisenatureknee[.]com
themostbeautifulspark[.]com