Ethereum's public RPC endpoints and smart contract data storage enable threat actors to distribute and update malicious infrastructure without redeploying malware binaries, reducing operational friction for attackers.
Too little corroboration in the last 3 days to call a trend (3 articles). Watching for it to gain traction.
Security researchers have identified that threat actors exploit Ethereum's public RPC endpoints and smart contract data storage to distribute malicious infrastructure, with the GoCaracal malware using eth_getStorage calls to retrieve updated command-and-control fallback addresses without redeploying binaries. Multiple public RPC providers create redundancy that reduces attackers' operational friction and dependency on single access points.
Infrastructure vulnerabilities that lower attacker operational costs can gradually erode confidence in network security and increase perceived counterparty risk for participants. When security friction decreases for malicious actors, it may eventually influence institutional adoption decisions and risk premiums embedded in asset valuations.
"The Ethereum setup gives operators a way to change the fallback address without distributing another GoCaracal binary. Multiple public RPC providers can also read the same smart contract data."
"The extended GoCaracal profile first attempts to communicate with its configured primary C2 server. After repeated failures, it sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint. The response provides a replacement address stored in the configured smart contract."
"Multiple public RPC endpoints can be used to read the same contract state, reducing dependence on a single fallback access point. The smart-contract mechanism lets the operator change the replacement C2 address without shipping a new GoCaracal binary."