MFT Malicious Fungible Tokens

MFT Malicious Fungible Tokens

Speakers: Mauro Eldritch, Cybelle Oliveira

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=uCcyd3lTPXk

Overview

In their DEF CON 32 talk, "MFT Malicious Fungible Tokens," Mauro Eldritch and Cybelle Oliveira unveiled a groundbreaking approach to command and control (C2) infrastructure, leveraging the inherent immutability and decentralized nature of Non-Fungible Tokens (NFTs). While the title playfully references "Fungible Tokens," the core innovation presented centers entirely on NFTs as a resilient, "immortal" C2 mechanism. The speakers demonstrated how adversaries could embed malicious instructions within NFT metadata or the associated off-chain digital assets, creating a C2 channel that is exceptionally difficult to detect, blacklist, or take down using conventional methods.

This presentation serves as a spiritual successor to their previous work, "Everything is a C2 if you're brave enough," where they explored using unconventional platforms like Spotify, World of Warcraft, and Wikipedia for C2 communications. By shifting focus to Web3 technologies, Eldritch and Oliveira highlight a new frontier for adversarial innovation, presenting a critical challenge to traditional cybersecurity defenses. Their research underscores the evolving landscape of cyber threats, demanding a re-evaluation of how C2 infrastructure is identified and mitigated.

The significance of this research lies in its potential to bypass established security paradigms. Traditional C2 servers, even those utilizing advanced evasion techniques or dark web infrastructure like Tor, remain susceptible to takedown efforts by law enforcement and security researchers. NFTs, by contrast, store information on immutable blockchains and decentralized storage networks, making the embedded C2 instructions virtually indestructible and perpetually accessible. This talk not only exposes a novel attack vector but also provides a stark warning about the long-term persistence of such threats.

Background

▶ Watch: Introduction: NFTs as Immortal C2 Servers (0:00)

The concept of Command and Control (C2) is fundamental to modern cyberattacks. A C2 server acts as the central communication hub for malware, allowing attackers to send commands to compromised systems and receive exfiltrated data. The effectiveness and longevity of a malware campaign are directly tied to the resilience of its C2 infrastructure. Historically, C2 servers have taken various forms, from dedicated web servers and IRC channels to more sophisticated techniques leveraging legitimate services, domain fronting, or encrypted tunnels. However, a common vulnerability across most traditional C2 methods is their susceptibility to takedown. Security researchers, law enforcement, and threat intelligence agencies actively work to identify, blacklist, and shut down malicious C2 servers, often by blocking IP addresses, domains, or disrupting hosting providers. Even C2s hosted on anonymity networks like Tor can eventually be identified and targeted, leading to disruption.

This constant cat-and-mouse game between attackers and defenders has driven adversaries to seek increasingly resilient and difficult-to-disrupt C2 channels. The speakers referenced their prior work, "Everything is a C2 if you're brave enough," which explored using platforms like Spotify, World of Warcraft, and Wikipedia to host C2 instructions, demonstrating a long-standing interest in unconventional C2 methodologies. This prior research established a precedent for leveraging legitimate, widely accessible, and often overlooked services to evade detection and takedown.

The advent of blockchain technology and Non-Fungible Tokens (NFTs) introduces a new paradigm for data storage and ownership. An NFT is a unique digital asset whose ownership is recorded on a blockchain. Critically, NFTs are characterized by their immutability and decentralization. While the ownership record and some metadata are stored directly on the blockchain (referred to as on-chain storage), the actual digital asset (e.g., an image, video, or document) is often stored off-chain in decentralized file systems like IPFS (InterPlanetary File System) or similar peer-to-peer networks. Once data is written to a blockchain or a decentralized storage network, it is exceptionally difficult, if not impossible, to alter or remove. This permanence, intended to guarantee ownership and authenticity, simultaneously creates an alluring opportunity for adversaries seeking an "immortal" C2 infrastructure, immune to conventional takedown mechanisms.

Key Findings

▶ Watch: NFTs for Resilient Command & Control (3:25)

The central finding of Eldritch and Oliveira's research is the successful demonstration that Non-Fungible Tokens (NFTs) can function as a highly resilient and effectively "immortal" C2 infrastructure for malware. This represents a significant shift from traditional C2 methods, which are vulnerable to centralized takedown efforts. The core mechanism involves embedding C2 instructions directly into the data associated with an NFT, leveraging both on-chain metadata and off-chain decentralized storage.

Specifically, the researchers identified two primary methods for embedding C2 instructions:

1. On-chain Metadata: NFTs typically include metadata fields such as name, description, and traits. These fields are stored directly on the blockchain and are immutable once minted. Adversaries can encode commands or pointers to further instructions within these textual fields.
2. Off-chain Decentralized Storage: While the blockchain records ownership, the actual digital asset represented by the NFT (e.g., an image) is usually stored off-chain in a highly distributed, decentralized network. The speakers noted that when an image is uploaded for an NFT, it might be converted into formats like AVIF and then distributed across "seats" (nodes) in this decentralized storage. This off-chain asset, which is also effectively immutable and globally accessible, can serve as a much larger repository for C2 payloads, configuration files, or a sequence of commands.

The critical advantage of this approach is its inherent resistance to takedown. Unlike C2 servers hosted on traditional web servers or even Tor, there is no central server to ban, blacklist, or shut down. Once the malicious instructions are embedded within an NFT and recorded on the blockchain or its associated decentralized storage, they become permanent and globally accessible. This "immortality" ensures that the C2 instructions persist indefinitely, making it incredibly challenging for defenders to neutralize the threat at its source. The research highlights that while an NFT marketplace might flag or delist a malicious NFT, the underlying data on the blockchain and decentralized storage remains untouched and accessible to malware designed to retrieve it.

Technical Deep Dive

▶ Watch: Demonstration Setup: Golden Locker Malware (4:30)

The technical implementation of an NFT-based C2 infrastructure hinges on the immutable nature of blockchain and decentralized storage. The speakers detailed how an NFT's structure, designed for digital asset verification, can be subverted for malicious purposes.

An NFT is fundamentally a pointer on a blockchain to a digital asset and its associated metadata. This metadata typically includes human-readable fields like name, description, and various traits (e.g., "color," "rarity"). These textual fields, stored directly on-chain, offer a small but permanent space to embed initial C2 instructions, encryption keys, or links to more extensive payloads. For instance, a description field could contain a base64-encoded command or a URL pointing to a larger instruction set.

However, the more significant capacity for C2 data lies in the off-chain storage of the actual digital asset. When an image or other file is minted as an NFT, it's typically uploaded to a decentralized storage solution, often implied to be similar to IPFS (InterPlanetary File System), though not explicitly named in the talk. The transcript mentions the file being "highly distribute among the seats," which is characteristic of such decentralized networks. Crucially, the talk noted that images uploaded for NFTs might be converted into formats like AVIF (AV1 Image File Format). This conversion process, or the original file itself, can be manipulated to embed hidden data, such as steganographically encoded commands, encrypted payloads, or even entire scripts. The malware would then retrieve this AVIF file, decode the embedded instructions, and execute them.

The C2 communication flow would therefore operate as follows:

1. A compromised host, infected with malware (e.g., Golden Locker as demonstrated), is programmed to query specific NFT data. This query might involve looking up an NFT by its contract address and token ID on a blockchain explorer or an NFT marketplace API (like OpenSea).
2. The malware then retrieves the NFT's metadata (on-chain) and/or the associated digital asset (off-chain).
3. Upon retrieval, the malware decodes the embedded instructions. This could involve base64 decoding from a description field, decrypting an obfuscated string, or extracting steganographically hidden data from an image file.
4. Once decoded, these instructions form an "action plan," dictating further malicious activities. As demonstrated, these actions could include host enumeration commands like whoami, id, and hostname to uniquely identify the compromised system, or other "shenanigans" as mentioned by the speakers.

This architecture presents a formidable challenge to traditional C2 takedown. There is no single server to block; the C2 instructions are "baked" into the distributed and immutable fabric of Web3 infrastructure. The resilience of this method stems from the fact that even if an NFT marketplace delists or flags the item, the underlying data on the blockchain and decentralized storage remains accessible to any client capable of querying it directly. This makes the C2 practically immortal and globally reachable, posing a persistent threat that cannot be easily eradicated.

Demo / Proof of Concept

▶ Watch: Malware Actions: Host Identification and Shenanigans (5:00)

The speakers provided a compelling demonstration of their NFT-based C2 concept, utilizing a malware sample they referred to as Golden Locker. For safety and to avoid any unintended damage, both the Golden Locker malware and its NFT C2 server component were run on the same machine. This isolated environment allowed them to showcase the core functionality without impacting external systems.

The primary objective of the demonstration was to illustrate how the malware could retrieve and decode instructions embedded within an NFT. The process involved the Golden Locker malware attempting to "decode the instructions that are hosted on the malware," which, in the context of an NFT C2, implies the malware was designed to fetch and interpret data from the designated NFT. Although the network was "not cooperating" during the live demonstration, the conceptual flow was clearly articulated.

Once the instructions were successfully decoded from the NFT, they formed an "action plan" for the malware. The specific commands demonstrated as part of this action plan were:

• whoami: To identify the current user context.
• id: To display user and group IDs.
• hostname: To reveal the network name of the compromised host.

These commands are typical initial reconnaissance steps for malware, allowing attackers to gather basic information about the compromised system and uniquely identify the host. The speakers also alluded to "some other shenanigans" that could be performed, indicating the flexibility of this C2 mechanism to deliver a wide array of subsequent malicious actions.

Crucially, the speakers confirmed that the tool used for this research has been publicly released. They encouraged attendees and the broader security community to experiment with it, stating, "You can actually create your own Metamask address, jump to OpenSea and start fiddling with it. Feel free to fork it, change it, your call." This open-source availability allows other researchers and security professionals to replicate their findings, explore variations, and develop new detection and mitigation strategies against this novel threat vector.

Defensive Implications

▶ Watch: Tool Released: How to Access and Experiment (6:00)

The emergence of NFT-based C2 infrastructure presents a profound challenge to existing cybersecurity defensive strategies. The inherent characteristics of blockchain and decentralized storage — immutability and global distribution — render traditional C2 takedown methods largely ineffective. Defenders can no longer rely on simply blocking IP addresses, domains, or issuing takedown notices to hosting providers.

Takedown and Remediation: The most significant implication is the near impossibility of a traditional takedown. Once C2 instructions are embedded in an NFT and recorded on the blockchain or its associated decentralized storage (like IPFS), they are permanent. Even if an NFT marketplace like OpenSea flags or delists a malicious NFT, the underlying data remains on the blockchain and distributed network, accessible to any malware programmed to retrieve it. This means that merely isolating or cleaning a compromised host might not be enough; the C2 source itself persists indefinitely.

Detection Strategies: The focus for defenders must shift from blocking the C2 source to detecting the malware's interaction with Web3 infrastructure and its subsequent malicious activities.

• Network Monitoring: Security teams need to monitor network traffic for unusual connections to blockchain nodes, NFT marketplaces, or decentralized storage gateways (e.g., IPFS gateways). While some legitimate traffic to these services might exist, unusual patterns, high volumes from internal systems, or connections from non-Web3-aware applications could be indicators.
• Endpoint Detection and Response (EDR): EDR solutions become critical for detecting the execution of commands retrieved from the NFT C2. Monitoring for processes attempting to access or parse data from Web3-related APIs, as well as the execution of suspicious commands like whoami, id, hostname, or any other "shenanigans" demonstrated, is paramount. Behavioral analysis to identify anomalous process activity linked to blockchain interactions will be essential.
• Threat Intelligence: Threat intelligence teams will need to expand their scope to include monitoring blockchain networks for suspicious NFT minting patterns, unusual smart contract deployments, or specific NFT IDs and wallet addresses associated with known malicious campaigns. The ability to identify "malicious NFTs" as IOCs will be crucial.
• Blockchain Analytics: Advanced blockchain analytics tools could potentially be used to identify patterns of interaction with specific NFTs or smart contracts that align with C2 activity. This might involve tracking the creation of NFTs with suspiciously encoded metadata or frequent access patterns from multiple sources.

Prevention: Proactive measures should include:

• Education: Raising awareness among users and developers about the potential for Web3 platforms to be abused.
• Application Whitelisting: Strictly controlling which applications can access network resources, especially those related to Web3.
• Gateway Security: Implementing robust security at network gateways to scrutinize and potentially restrict traffic to known blockchain services or decentralized storage networks if not explicitly required for business operations.

In essence, the NFT C2 forces a paradigm shift, moving defenders from a model of eradication at the source to one of continuous detection and containment at the endpoint, coupled with advanced threat intelligence within the Web3 ecosystem.

Key Takeaways

• NFTs as Immortal C2: Non-Fungible Tokens (NFTs) can be leveraged as highly resilient and "immortal" Command and Control (C2) infrastructure for malware, leveraging the immutable nature of blockchain and decentralized storage.
• Evasion of Traditional Takedown: This method effectively bypasses conventional C2 takedown strategies, as there is no central server to blacklist, ban, or shut down. Instructions persist on the blockchain and decentralized networks indefinitely.
• Data Embedding Methods: C2 instructions can be embedded in an NFT's on-chain metadata (e.g., description, traits) or within the off-chain digital asset itself (e.g., an AVIF image file, potentially via steganography).
• Shift in Defensive Focus: Defenders must adapt by focusing on detecting malware's interaction with blockchain/Web3 infrastructure and its subsequent malicious activities on endpoints, rather than attempting to neutralize the C2 source directly.
• New IOCs and Monitoring: Future threat intelligence will need to include NFT contract addresses, token IDs, and specific Web3 interaction patterns as Indicators of Compromise (IOCs). Monitoring network traffic to blockchain nodes and decentralized storage gateways is essential.
• Research Tool Released: The tool developed for this research has been made public, enabling security professionals and researchers to explore and develop countermeasures against this emerging threat.

About the Speaker(s)

Mauro Eldritch is an Uruguayan-Argentinian hacker with a notable presence in the cybersecurity community. He has spoken at various international events, sharing his expertise on novel attack vectors and security research. Mauro is also the leader of the Bitso Quetzal team, which stands as the first Latin American Web3 threats research team, highlighting his specialized focus on the security challenges within the decentralized web.

Cybelle Oliveira hails from São Paulo, Brazil, and is a dedicated professional in the field of cyber threat intelligence. Her work primarily involves researching and analyzing various forms of malware, including ransomware, and understanding their operational mechanisms. Cybelle's passion for dissecting malware and comprehending its inner workings complements Mauro's expertise in Web3 threats, making them a formidable research duo.