LenAI alliance reshapes ransomware ecosystem operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
LenAI is commercializing Aeternum C2 by selling panel access and later the full toolkit on underground forums, expanding access to a takedown-resistant botnet. The pricing ladder of $200, $4,000, and $10,000 shows a move from simple access sales to broader resale and commercial-use rights. That shift matters because it can put a ready-made crimeware stack in the hands of more operators.
Related Happenings
Aeternum C2 botnet loader using Polygon blockchain C2
Malware Activity
First: 26.02.2026 20:00
Last: 26.02.2026 20:00
Sources 1
How related:
Cybersecurity researchers have disclosed details of a new botnet loader called Aeternum C2 that uses a blockchain-based command-and-control (C2) infrastructure to make it resilient to takedown efforts.
About this happening:
Researchers disclosed **Aeternum C2**, a botnet loader that moves **command-and-control** onto the **Polygon blockchain**, making infected hosts harder to disrupt. The malware wri...
Aeternum C2 botnet loader using Polygon blockchain C2
Malware ActivityHow related: Cybersecurity researchers have disclosed details of a new botnet loader called Aeternum C2 that uses a blockchain-based command-and-control (C2) infrastructure to make it resilient to takedown efforts.
About this happening: Researchers disclosed **Aeternum C2**, a botnet loader that moves **command-and-control** onto the **Polygon blockchain**, making infected hosts harder to disrupt. The malware wri...
Timeline
-
26.02.2026 20:00 2 articles · 3mo ago
LenAI alliance reshapes ransomware ecosystem operations
Initial DisclosureIn **December 2025**, LenAI first surfaced the Aeternum C2 offering by promoting access on underground forums. The listing framed the malware as a configurable **panel-and-build** package, marking the start of its commercial sale cycle.
Show sources
- Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown — thehackernews.com — 26.02.2026 20:00
- Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown — thehackernews.com — 26.02.2026 20:00