MFT: Malicious Fungible Tokens
Introduces mFT, an open-source tool demonstrating how to use blockchain-backed non-fungible tokens as immutable command-and-control infrastructure.
Summary
Blockchain Backed Command and Control
Command and control (C2) infrastructure is routinely disrupted by domain seizures, IP blocklists, and hosting takedowns. Utilizing public blockchain smart contracts provides adversaries with decentralized, takedown-resistant channels.
Relaying Commands via Non Fungible Tokens
Non-Fungible Tokens (NFTs) deployed on public ledgers can store and relay encoded payload directives, system fingerprinting queries, and data exfiltration markers.
The mFT Automated Payload Tool
Researchers built 'mFT', an open-source toolkit that automates generating malicious NFT payloads and provides safe sample tokens for defensive testing.
Defensive Detection and Ledger Analysis
Monitoring public blockchain transactions and smart contract state changes enables defenders to identify covert C2 relay activities across enterprise networks.
Related talks
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.
Creator Stage·48 min
Asher Davila
Examines the challenges of analyzing Go-based IoT malware and demonstrates reversing techniques using the Pumabot surveillance botnet as a case study.
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.