blockchain-c2 5
- Another day, another 1,738 compromised websites: ClickFix keeps leaning on EtherHiding for C2
- The ledger keeps talking: mapping five EtherHiding operators, two kit families, and 1,829 confirmed hacked websites
- No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
- Reading the ledger: how one Polygon smart contract exposed three ClickFix crews and 153 confirmed hacked websites
- Five layers deep for a stealer: reversing the "PuppetKing" ClickFix chain that ended in StealC