ChainScript RAT Uses Polygon to Rotate Command‑and‑Control

A threat actor group has introduced a previously undocumented remote access trojan (RAT) named ChainScript, which is delivered through lures resembling legitimate software installers such as Spotify, Zoom Workplace, and Microsoft Teams¹. The malware appears under several build names—ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66—and presents itself as trusted applications to trick users into installing it¹.

The attackers behind this campaign have been identified as Blackpoint Adversary Pursuit Group (APG), an adversarial unit known for using sophisticated social engineering tactics¹. APG’s latest technique relies on the Ethereum-based smart contract platform Polygon, formerly Matic, to host and rotate the command‑and‑control (C2) servers that communicate with infected machines¹.

Polygon’s Layer‑2 scaling solution allows ChainScript’s C2 infrastructure to run across many nodes without a single point of failure. By rotating the addresses used by ChainScript every few hours, the operators can evade network takedown efforts that typically target static IPs or domains¹. This approach mirrors earlier tactics seen in late 2018 when CoinJoin services on Bitcoin rotated their mixing servers frequently and often combined Tor relays for obfuscation, making disruption difficult for law enforcement agencies worldwide.

Security specialists note that blockchain technologies like Polygon make attribution challenging but not impossible if investigators gather enough data over time; the decentralized nature reduces centralized points where defenders could intervene. The use of Polygon also means that even if one node is taken down, others continue to provide routing information, allowing attackers to maintain persistent control over compromised hosts.

Experts warn that this method will likely become more common as threat actors observe its success against other high‑profile campaigns such as those run by APT10 in 2017, which employed DNS tunneling over Tor before moving to Bitcoin transactions for obfuscation. They emphasize the need for better secure coding practices within development environments themselves since many firms rely on code repositories exposed online without proper access controls.

For organizations facing potential exposure to ChainScript, vigilance remains essential. Monitoring for unusual update prompts that mimic popular software, verifying digital signatures, and employing network segmentation can reduce the risk of infection. Additionally, security teams should consider deploying detection mechanisms specifically tuned to identify interactions with Polygon smart contracts or similar layer‑two platforms used for C2 rotation.

In summary, ChainScript’s deployment via ClickFix-like lures combined with a Polygon‑based command infrastructure represents a significant evolution in RAT design, offering resilience against takedown efforts while exploiting user trust through familiar application names¹. The incident underscores the importance of continuous monitoring and robust defense strategies in an environment where blockchain technologies increasingly serve both legitimate and malicious purposes alike¹