# PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT

PHANTOMPULSE RAT resolves C2 from latest transaction input to a fixed wallet without verifying sender, letting anyone hijack all implants via one transaction.

- Payout: Real-world hack
- Severity: high
- Program: PHANTOMPULSE
- Analysis by: Salim Bitam
- Disclosed: 2026-05-22
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/blockchain-c2-phantompulse-rat-sinkhole
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-blockchain-c2-phantompulse-rat-sinkhole
- Tags: area:web3 domain:web3 impact:integrity impact:internal-access kind:incident platform:threat-intel sev:high tech:evm technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** Blockchain C2 resolver (Ethereum/Base/Optimism Blockscout transaction input)
**Root cause:** The resolver does not verify the sender of the transaction. It only checks that the latest decoded input starts with http.
**Steps:**
1. Implant queries eth/base/optimism.blockscout.com for latest transaction to wallet `0xc117688c530b660e15085bF3A2B664117d8672aA`
2. Pulls the `input` field, hex-decodes it, XOR-decrypts with the wallet address bytes as key
3. Validates decoded result begins with `http`; no sender check
4. Attacker submits own transaction to that wallet with a URL XOR-encoded under the wallet bytes
5. Every implant polling afterward resolves to attacker URL
**How found:** Reverse-engineering the C2 resolver: observed it pulls the latest transaction input, XOR-decrypts with wallet bytes, and only validates the `http` prefix — noting the absence of any sender verification.
**Exploitation:** Anyone can submit a transaction to the resolver wallet with their own URL XOR-encoded under the wallet address bytes; every PHANTOMPULSE instance of the campaign that polls afterward resolves to that URL, giving a sinkhole at the cost of one transaction.
**Insight:** When a resolver reads the latest tx to a fixed address, check whether sender is validated; a single attacker tx can redirect all clients. Also: known-plaintext XOR (URL starts 'ht', key starts '0x') yields a chain-wide hunt signature `0x580c`.

## Proof of concept (copied exactly from the original report)

**BigQuery hunt for resolver wallet signature**

```
SELECT 
 block_timestamp AS block_time, 
 from_address AS `from`, 
 to_address AS `to`, 
 input AS data
FROM `bigquery-public-data.crypto_ethereum.transactions`
WHERE block_timestamp >= '2026-04-01 00:00:00'
 AND input LIKE '0x580c%'
ORDER BY block_timestamp DESC
LIMIT 10000;
```

**Heartbeat JSON system profile**

```
{
 "machine_id": "<uint32>",
 "status": "online",
 "cpu": "<model>",
 "gpu": "<description>",
 "ram_mb": "<uint32>",
 "os": "<version>",
 "username": "<user>",
 "computer_name": "<name>",
 "cores": "<uint32>",
 "screen_w": "<int>",
 "screen_h": "<int>",
 "privilege": "<user|admin|admin_nouac|system>",
 "build": "payloads",
 "public_ip": "<ip>",
 "av_list": ["<av1>", "<av2>"],
 "apps": ["<app1>", "<app2>"],
 "last_cmd": "<cmd>",
 "last_cmd_result": "<result>"
}
```