# ZOMBI RAT: Solana Blockchain C2 and Self-Propagating Credential Theft

- **Artifact ID:** CHQ-EX-2026-012
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-012
- **Machine-record SHA-256:** `1d0b0d6e50f36cd85ad77cc37cdfc0de71a4fbbdae7f46bc3cd114403c07fdb2`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-012",
  "title": "ZOMBI RAT: Solana Blockchain C2 and Self-Propagating Credential Theft",
  "subtitle": "Final-stage payload of the GlassWorm campaign. Full remote access trojan using Solana blockchain as censorship-resistant command-and-control with autonomous credential theft enabling self-propagation across developer registries.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, cascade mechanisms, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (NOVEMBER 2025 TO MARCH 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "CONTEXT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2025-11-01",
    "temporal_end": "2026-03-31"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Payload Designation: ZOMBI module, as designated by Fluid Attacks and corroborated by multiple independent research teams.",
        "C2 Architecture: Solana blockchain used as dead-drop resolver. Malware queries hardcoded wallet address across nine legitimate public Solana RPC endpoints at 5-second intervals. Transaction memo fields contain AES-256-encrypted payload URLs. Earliest transaction on primary C2 address dates to November 27, 2025. 50 total transactions identified between November 2025 and March 2026, with attacker regularly updating payload URLs, sometimes multiple times per day. Wallet rotation implemented to evade detection.",
        "C2 Properties: Censorship-resistant (no hosting provider to issue takedown). Immutable (on-chain data permanent). Free and anonymous reads (no rate limits, no IP logging at protocol level). Traffic indistinguishable from legitimate blockchain interaction (domain reputation tools do not flag Solana RPC queries).",
        "Credential Theft Functions: npm authentication tokens, GitHub personal access tokens, Open VSX publisher credentials, Git credentials, SSH keys. Stolen credentials used for autonomous spread: force-pushing malicious commits to victim repositories, publishing poisoned package versions, updating victim extensions.",
        "Additional Functions: Cryptocurrency wallet drain targeting 49 browser wallet extensions (including Coinbase Wallet, MetaMask, Phantom). Internal network reconnaissance mapping corporate networks accessible from infected workstations. Chromium browser data theft (cookies, credentials). Persistence via Windows Registry Run keys and scheduled tasks.",
        "Distributed C2: WebRTC modules for peer-to-peer communication using NAT traversal. BitTorrent Distributed Hash Table (DHT) network for command distribution. Decentralized architecture eliminates single point of failure.",
        "Execution Guardrails: Russian locale exclusion (skips execution on systems with Russian locale configuration). Environment profiling before detonation. System fingerprinting to avoid sandbox/analysis environments.",
        "Indicators: Solana wallets BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC and 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ. C2 IPs 45.32.150.251, 45.32.151.157, 70.34.242.255. AES key wDO6YyTm6DL0T0zJ0SXhUql5Mo0pdlSz, IV c4b9a3773e9dced6015a670855fd32b. Persistence file ~/init.json. Unexpected Node.js installations ~/node-v22*. Marker variable lzcdrtfxyqiplpd."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The ZOMBI module represents the convergence of three structural capabilities that traditional security countermeasures are not designed to address simultaneously: censorship-resistant infrastructure (blockchain C2 that cannot be taken down through domain seizure or hosting provider cooperation), autonomous propagation (credential theft that produces the infrastructure for the next credential theft without attacker intervention), and developer environment targeting (payloads designed for the specific credential and secret types that enable supply chain propagation).",
        "The blockchain C2 architecture is not a proof of concept. It operated continuously for over four months with 50 payload rotations. The operational cost is negligible (Solana transaction fees). The infrastructure survived multiple registry takedown actions against downstream delivery mechanisms because the C2 channel is independent of any specific registry or hosting provider.",
        "The self-propagating credential theft cycle means that disrupting any single delivery mechanism (removing malicious extensions, revoking compromised tokens, taking down npm packages) does not disrupt the campaign if the C2 infrastructure and any infection remain active. The attacker can rebuild delivery infrastructure using credentials already stolen. The campaign’s resilience is proportional to the number of active infections, not to the attacker’s infrastructure investment."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-EX-2026-009 — Exhibit: GlassWorm Wave 1–3 Multi-Registry Supply Chain Campaign (parent exhibit).",
        "CHQ-ED-2026-012 — Evidence Docket: Portable Developer Identity.",
        "CHQ-P-2026-013 — Position: Portable Developer Identity."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No evaluative judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: November 2025 to March 2026. Exhibit issuance date is March 20, 2026.\n\nThis Exhibit records technical findings as reported by named security research organizations, not as established fact. Source: Fluid Attacks (ZOMBI designation and analysis), StepSecurity (Solana C2 timeline and transaction analysis), Socket (payload analysis), Aikido Security (GitHub propagation analysis). Indicators of compromise as published by StepSecurity and Fluid Attacks.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-03-20"
}
```