[mikefallen]

Can anyone link to an article that goes into goes into detail on how the botnet uses blockchain to recover the botnet after they disrupt the c2. This seems interesting.

[codezero]

They are hard coded to watch certain wallets for transactions on the chain if their normal c2 servers are offline. The transactions contain their new servers/other instructions.

[vital_beach]

this lists the addresses and keys and breaks down how it works

https://blog.google/threat-analysis-group/disrupting-glupteb...