Botnets exploit .bit blockchain domains for bulletproof C2
Cybercriminals are leveraging Namecoin's decentralized .bit TLD to host botnet C2 infrastructure that cannot be seized or taken down through traditional means.
Botnet operators have increasingly adopted Namecoin's .bit top-level domain for hosting command-and-control infrastructure, exploiting its decentralized blockchain architecture to create effectively bulletproof hosting. Unlike ICANN-governed TLDs, .bit domains are completely decentralized, anonymous, and cannot be suspended by any registry or law enforcement. The article documents a Chthonic banking trojan C2 domain that remained active for nine months—an unprecedented longevity compared to traditional botnet infrastructure.
Malware families including Chthonic, Smoke Loader, Backdoor.Teamviewer, Necurs, Shifu, and TinyNuke have been observed hardcoding OpenNIC DNS servers into their code to resolve .bit domains. OpenNIC operates 61 volunteer-run DNS servers that bridge the gap between the standard DNS hierarchy and the .bit namespace. Testing revealed that only 8 of 52 OpenNIC servers (15%) apply any abuse filtering, creating inconsistent blocking across the infrastructure.
The .bit domains cost approximately $0.024 to register, have no whois information, and require no registrant details. The Chthonic campaigns documented used RIG exploit kit for drive-by infections and frequently updated their C2 IP addresses through the blockchain. Organizations not using OpenNIC are advised to block OpenNIC DNS servers at the firewall to prevent infected systems from communicating with .bit-based C2 infrastructure.
Mentioned in this report
Detection guidance
DNS Query for .bit Blockchain TLD Domain
Detects DNS resolution attempts for .bit domains, a non-ICANN blockchain TLD used by malware (Chthonic, Smoke Loader, Necurs, Shifu, TinyNuke) for bulletproof C2 hosting. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DNS Query for .bit Blockchain TLD Domain
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|endswith: .bit
condition: selection
falsepositives:
- Rare legitimate research or testing of Namecoin/OpenNIC infrastructure
level: high
tags:
- attack.t1568.002
- attack.command_and_control
id: 4ff48921-d791-52e7-ae1a-6428a473800a
status: experimental
author: Vorant
HTTP Connection to .bit Domain Host
Detects outbound HTTP/HTTPS requests where the destination hostname or Host header ends in .bit, indicating C2 communication over a blockchain-based domain resolved via OpenNIC infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Connection to .bit Domain Host
logsource:
category: proxy
product: windows
detection:
selection:
c-uri-host|endswith: .bit
condition: selection
falsepositives:
- Internal testing of Namecoin-based decentralized services
fields:
- c-uri-host
- src_ip
- dst_ip
level: high
tags:
- attack.t1071.001
- attack.command_and_control
id: e3cd27e0-efc9-58fa-9be5-d66a72aa464f
status: experimental
author: Vorant
System DNS Server Reconfigured via netsh to Non-Standard Resolver
Detects use of netsh to set a static, non-corporate DNS server, a technique used by malware families to force resolution through OpenNIC servers capable of resolving .bit domains. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: System DNS Server Reconfigured via netsh to Non-Standard Resolver
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \netsh.exe
CommandLine|contains|all:
- interface
- set
- dns
filter:
CommandLine|contains:
- dhcp
condition: selection and not filter
falsepositives:
- Legitimate IT administration scripts that statically configure DNS servers on endpoints
- VPN client configuration tools that set custom DNS resolvers
level: medium
tags:
- attack.t1071.001
- attack.defense_evasion
id: ff732043-e3f5-54fe-aea4-e18a34950b78
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://abuse.ch/blog/dot-bit-the-next-generation-of-bulletproof-hosting
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free