The Solana blockchain at the service of hackers

Solana blockchain at the service of hackers🪙

In January, specialists from the cyber intelligence group of the Threat Intelligence department at the PT Expert Security Center (PT ESC) discovered an attack using a malicious XLL file.

📂 Inside it was a chain of obfuscated JavaScript files running on the NodeJS platform. The victim’s system was infected with malware of the RAT (Remote Access Trojan) class, featuring a wide range of available commands.

Among the features of the malicious code, the use of SNS records (Solana Name Service) was identified for obtaining an alternative address for the attackers’ server. A detailed investigation made it possible to expand the timeframe of the attack: malicious activity has been recorded since mid-October 2025 and continues to this day.

Details — in our article on Habr 👉

#TI #Phishing #Malware
@ptescalator (X, Max)