Carved in Stone: Malware [ab]use of the Bitcoin Blockchain

Carved in Stone: Malware [ab]use of the Bitcoin Blockchain

Speakers: Gibran Alberto Gómez Montez, Researcher, IMDEA Software Institute

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=fyutVF9hJH8

Overview

This talk, "Carved in Stone: Malware [ab]use of the Bitcoin Blockchain," presented by Gibran Alberto Gómez Montez from the IMDEA Software Institute, delves into the sophisticated ways cybercriminals leverage the Bitcoin blockchain beyond its well-known use as a payment channel. While Bitcoin's properties—pseudo-anonymity, decentralization, public ledger, and often unregulated nature—make it attractive for illicit financial transactions, this research highlights its increasing exploitation for robust and resilient data propagation. Gómez Montez, along with his team Juan Cavero, Pedro Moreno, and Kevin Van Liberen, demonstrate how malware families use the blockchain for command and control (C2) signaling and even for releasing decryption keys to ransomware victims.

The presentation underscores the critical need for advanced blockchain analysis techniques, moving beyond traditional "forward tracing" to incorporate "backward analysis" for more effective attribution. By developing a specialized platform and "operation oracles," the research uncovers previously unknown aspects of malware operations, significantly improving the estimation of their scale and financial gains. This work is crucial for understanding the evolving landscape of cybercrime and equipping defenders with the tools to detect, track, and potentially disrupt these illicit activities that are literally "carved in stone" on the immutable blockchain.

Background

▶ Watch: Introduction and Bitcoin's appeal to cybercrime (0:00)

Bitcoin's design, intended for secure and decentralized digital payments, inadvertently provides a fertile ground for various cybercriminal activities. Its core properties—being pseudo-anonymous (transactions are linked to addresses, not identities, unless deanonymized), public (all transactions are visible on the ledger), decentralized (no single point of control), and largely unregulated in many jurisdictions—are highly appealing to those operating outside the law.

Historically, the most common form of Bitcoin abuse has been as a payment channel for illicit services. This includes darknet marketplaces like the infamous Silk Road, money laundering operations, and various forms of extortion. Sextortion scams, where attackers claim to have compromising information and demand Bitcoin payments, are a widespread example. Ransomware represents another significant threat in this category, encrypting victims' files and demanding cryptocurrency for decryption. Modern ransomware often employs a double extortion scheme, threatening to leak sensitive data if the ransom isn't paid, thereby increasing pressure on victims. Beyond these, Bitcoin is used in investment scams, romance scams, and for facilitating the theft of computing power through cryptojacking malware (though current cryptojacking predominantly mines Monero, not Bitcoin).

However, the talk pivots to a less commonly understood but equally critical area of abuse: data propagation. Bitcoin's public and immutable ledger makes it an exceptionally resilient mechanism for storing and disseminating data without needing a central authority. This has led to two primary forms of exploitation:

1. Command and Control (C2) signaling: Malware botnets use the blockchain to publish the ever-changing locations of their C2 servers, ensuring that infected bots can always find their next instructions.
2. Key release to ransomware victims: In some ransomware schemes, the decryption keys are embedded directly into blockchain transactions, allowing victims to retrieve them after payment.

Previous efforts to analyze these activities primarily relied on forward tracing, a technique that follows the flow of funds from an initial address to subsequent addresses. While useful, this approach has significant limitations, particularly in identifying the origin of funds or detecting operations where money is quickly drained and replenished. The problem is compounded by the scarcity of publicly available tags, which are pieces of information linking Bitcoin addresses to known entities like exchanges or specific malware operations. This limited visibility makes it challenging to identify "change of ownership" in transactions, hindering comprehensive analysis and attribution.

Key Findings

▶ Watch: Blockchain analysis methodology and backward tracing (8:50)

The research presented by Gibran Alberto Gómez Montez and his team unveils several critical findings regarding malware's abuse of the Bitcoin blockchain, significantly advancing the understanding of these sophisticated operations.

Firstly, the talk firmly establishes that malware extensively leverages the Bitcoin blockchain not just for illicit payments but also as a highly resilient and decentralized mechanism for data propagation. This includes Command and Control (C2) signaling for botnets and the unique strategy of releasing decryption keys directly to ransomware victims via the public ledger. The immutability and global reach of the blockchain make it an ideal, censorship-resistant channel for these purposes.

A central technical finding is the widespread use of the OP_RETURN transaction output. This special output allows a small amount of arbitrary data (up to 80 bytes) to be embedded directly into a Bitcoin transaction. Malware families like Glosa encrypt C2 domain names into OP_RETURN fields, while DeadBolt ransomware uses it to store decryption keys. This mechanism ensures that critical operational data is permanently "carved in stone" and accessible to any bot or victim with an internet connection, without relying on traditional, easily disruptable infrastructure.

The researchers developed a novel blockchain analysis platform and introduced the concept of Operation Oracles. These oracles are essentially classifiers trained to identify specific, unique transaction patterns characteristic of different malware families. By applying these oracles, the team demonstrated the ability to automatically detect and classify known malware activities on the blockchain, even for previously unknown addresses. This approach allowed them to identify numerous previously unknown signaling addresses for C2 operations like Servers, Pony, SkitMap, and Glosa.

Crucially, the research highlights the limitations of traditional "forward tracing" (following money out) and demonstrates the power of backward analysis (tracing money into an operation). This reverse tracing is vital for identifying attribution points, particularly regulated cryptocurrency exchanges that act as initial funding sources for malware operations. For instance, the analysis of the Pony botnet revealed one attribution point by tracing funds backward, a finding impossible with forward tracing alone. Similarly, SkitMap yielded three attribution points. These findings are significant because regulated exchanges typically adhere to Know Your Customer (KYC) policies, offering potential leads for law enforcement.

Perhaps one of the most impactful findings relates to the DeadBolt ransomware. By applying their operation oracle to the entire Bitcoin blockchain for the period DeadBolt was active, the researchers achieved what they believe is 100% coverage of DeadBolt victims. This comprehensive analysis revealed a staggering 39-fold increase in the estimated revenue for DeadBolt, jumping from a mere 2.8 Bitcoins (estimated via traditional methods like internet scanners) to 98.3 Bitcoins. This dramatic revision underscores the severe underestimation of cybercrime's financial scale when relying solely on conventional detection techniques, demonstrating the profound impact of advanced blockchain forensics.

Technical Deep Dive

▶ Watch: Operation Oracles: Classifying malware C2 signaling (15:50)

The technical core of this research revolves around an innovative approach to blockchain analysis, moving beyond superficial transaction monitoring to deep pattern recognition and graph-based investigation.

At the heart of Bitcoin's data propagation abuse is the OP_RETURN transaction output. Bitcoin transactions typically involve inputs (unspent transaction outputs or UTXOs) and outputs. An OP_RETURN output is a special type that allows for embedding arbitrary data directly into a transaction, up to a maximum of 80 bytes. While these outputs are provably unspendable (meaning the funds associated with them are permanently destroyed), their immutability on the blockchain makes them perfect for malware to store critical information like C2 server locations or decryption keys. For example, Glosa malware encrypts its C2 domain name using AES and stores this ciphertext within an OP_RETURN field.

To retrieve this data, infected bots (or ransomware victims) don't need to run a full Bitcoin node. They can query third-party services called blockchain explorers (e.g., blockchain.info). These services parse the entire blockchain and present transaction data in an easily accessible web format. Bots simply request all transactions associated with a known address, identify the latest OP_RETURN output, decrypt its content (using an embedded key), and then connect to the C2 server.

The research's analytical methodology is built upon constructing transaction graphs. In these graphs, Bitcoin addresses are represented as nodes, and transactions are represented as edges. Deposits show funds entering an address, while withdrawals show funds leaving. To make these graphs meaningful and avoid "graph explosion" (where the graph becomes unmanageably large due to interconnected transactions), the researchers employ several crucial components:

1. Tags: These are pieces of external information that link specific Bitcoin addresses to known entities. Examples include addresses found in ransomware notes (e.g., belonging to DeadBolt), or addresses published by legitimate services like exchanges or gambling sites. Tags are essential for identifying change of ownership, signaling when funds move from a criminal operation to a legitimate service, or vice versa.
2. Exchange Classifier: Recognizing the scarcity of reliable public tags, the team developed a machine learning-based classifier. This classifier helps to automatically identify addresses belonging to cryptocurrency exchanges, thereby augmenting the limited manual tags and improving the detection of ownership changes.
3. Heuristics: Various heuristics are used to "cut" the transaction graph when a change of ownership is detected. This prevents the graph from growing uncontrollably and focuses the analysis on the relevant operational scope of the malware.

The platform supports two main tracing techniques:

• Forward Tracing: The traditional method, starting from a seed address and following all outgoing transactions to see where the funds go. While useful for tracking spent funds, it fails to identify who funded the operation.
• Backward Analysis: A novel and critical component of this research. This technique traces funds into the seed address, exploring all incoming transactions. This is particularly powerful for identifying attribution points, such as exchanges or mixing services that deposit funds into the malware operation's wallets. Since many exchanges are regulated and require KYC, these attribution points can provide valuable intelligence for law enforcement. The talk highlights its utility for analyzing mixers, where forward tracing is ineffective due to obfuscated money flows.

A cornerstone of their detection capabilities are Operation Oracles. These are specialized classifiers trained on the unique transaction patterns of specific malware families:

• Servers Oracle: This C2 signaling mechanism involves the C2 address (C) making a small deposit to a disposable address (D), which then immediately sends the money back to C. The botnet extracts the first six characters of address D, appends a TLD (e.g., .top), to construct the C2 domain. The tool successfully found three previously unknown signaling addresses for Servers malware.
• Pony and SkitMap Oracle: These families, though potentially unrelated, share a similar C2 signaling protocol. A disposable address (D) makes two deposits to the C2 address (P). The values of these two transactions are converted to hexadecimal, split, and then transformed back to decimal to form the four octets of an IP address. The analysis identified eight previously unknown Pony signaling addresses and one attribution point, and one relation to a previous SkitMap version with three attribution points.
• Glosa Oracle: As mentioned, Glosa uses OP_RETURN fields to store AES-encrypted C2 domain names. The oracle detects the characteristic pattern of repeated OP_RETURN transactions from a consistent address.
• DeadBolt Oracle: This ransomware's key release mechanism is highly distinct. After a victim pays (Transaction 1 to payment address P), the ransomware authors generate Transaction 2 from a key-delivery address (K). This Transaction 2 has three specific outputs: a tiny payment back to P, an OP_RETURN containing the decryption key, and the remaining funds returned to K (acting as a change address). By identifying Transaction 2 patterns, the oracle can find all key-release addresses and subsequently all victim payments. This oracle led to the 39x increase in estimated DeadBolt revenue, confirming full coverage including the 155 keys recovered by the Dutch police.

The researchers also briefly touched upon clustering heuristics, specifically mentioning the multi-input heuristic. This heuristic assumes that if a transaction has multiple input addresses, those addresses likely belong to the same entity, as they would all require the same private key(s) to sign the transaction. However, they explicitly avoid applying this heuristic to mixing transactions, as mixers intentionally combine inputs from unrelated entities, which would introduce noise and false positives into the clustering.

Demo / Proof of Concept

▶ Watch: Underestimated revenue: DeadBolt victim coverage increase (29:50)

While the talk does not feature a live demonstration of the developed platform, the presentation itself serves as a robust proof of concept through the detailed analysis and graphical representations of various malware operations. The speaker showcases numerous transaction graphs generated by their tool, visually illustrating the patterns detected by the operation oracles.

For instance, graphs are presented for the Servers malware, clearly showing the characteristic "loops" of money flowing from a C2 signaling address to a disposable address and back, with evident interaction between multiple C2 addresses. Similarly, the Pony and SkitMap graphs highlight the distinct two-transaction patterns used for IP address signaling, and critically, demonstrate the discovery of attribution points through backward analysis. The Glosa graphs depict two distinct components, suggesting simultaneous use of multiple signaling addresses.

The most compelling "proof of concept" is the comprehensive analysis of DeadBolt ransomware. The presentation includes graphs showing the daily payment spikes and the stark contrast between traditional revenue estimates and the significantly higher figures obtained using their Oracle-driven blockchain analysis. The ability to identify all 155 keys recovered by the Dutch police, and to then extrapolate to a 100% coverage of DeadBolt victims, stands as a powerful validation of their methodology. These visual and statistical results effectively demonstrate the platform's capability to detect, track, and quantify the impact of blockchain-abusing malware.

Defensive Implications

▶ Watch: Q&A: Clustering wallets for law enforcement attribution (34:00)

The research presented offers crucial insights and actionable intelligence for cybersecurity defenders, law enforcement, and even cryptocurrency exchanges.

1. Enhanced Attribution for Law Enforcement: The most significant defensive implication is the power of backward analysis for attribution. By tracing funds into malware operations, law enforcement can identify the initial funding sources, often regulated cryptocurrency exchanges. Since many exchanges adhere to Know Your Customer (KYC) and Anti-Money Laundering (AML) policies, these attribution points can provide critical leads to identify the real-world identities of cybercriminals. This shifts the focus from merely tracking stolen funds to potentially apprehending the perpetrators. The findings on Pony and SkitMap, identifying attribution points, are direct examples of this potential.

1. Proactive Detection with Operation Oracles: The development of Operation Oracles provides a powerful tool for proactive threat intelligence. Security analysts can train oracles on known malware families' blockchain behaviors. This allows for automated scanning of the blockchain to detect new instances of these operations, identify previously unknown C2 addresses, or discover new key-release addresses for ransomware. This moves beyond reactive detection to a more predictive and comprehensive monitoring strategy.

1. Monitoring OP_RETURN for C2 and Key Release: Defenders should specifically monitor the OP_RETURN fields in Bitcoin transactions for patterns indicative of C2 signaling or ransomware key releases. While the data is often encrypted, the mere presence of specific transaction patterns from certain addresses could flag suspicious activity, allowing for deeper investigation.

1. Improved Revenue Estimation and Threat Prioritization: The DeadBolt case vividly demonstrates that traditional methods severely underestimate the financial scale of cybercrime. By employing advanced blockchain analysis, defenders can gain a more accurate understanding of the revenue generated by various malware operations. This improved estimation is crucial for threat prioritization, helping organizations and law enforcement allocate resources more effectively to counter the most financially impactful threats. A 39x increase in estimated revenue for DeadBolt highlights the hidden scale of these illicit economies.

1. Disruption Potential (Leveraging Automation Flaws): The Dutch police's successful recovery of 155 DeadBolt keys by exploiting the ransomware's automated key release mechanism offers a blueprint for potential disruption. If malware operations rely on automated processes to interact with the blockchain, specific tactical interventions (e.g., transaction manipulation in the mempool, as demonstrated by the Dutch police) could be employed to disrupt their operations, steal keys, or misdirect botnets. This requires a deep understanding of the specific protocols used by the malware.

1. Awareness of Clipper Malware: While not the primary focus, the mention of Clipper malware serves as a reminder for users to always double-check cryptocurrency addresses before confirming transactions. Simple vigilance can prevent significant financial losses.

1. Reinforcing KYC/AML for Exchanges: The findings underscore the critical role of cryptocurrency exchanges in the broader cybersecurity ecosystem. Robust KYC/AML procedures are not just regulatory burdens but essential components in combating cybercrime. Exchanges that fail to implement or enforce these policies become unwitting enablers and hinder attribution efforts.

In essence, this research provides a roadmap for turning the immutable, public nature of the Bitcoin blockchain from a criminal advantage into a powerful forensic tool, enabling better detection, attribution, and potentially disruption of sophisticated malware operations.

Key Takeaways

• Beyond Payments: The Bitcoin blockchain is extensively abused not just for illicit payments, but also as a highly resilient and decentralized mechanism for malware Command and Control (C2) signaling and ransomware key release.
• Power of Backward Analysis: Traditional "forward tracing" (following money out) is insufficient. Backward analysis (tracing money into an operation) is crucial for identifying attribution points like cryptocurrency exchanges, which can provide leads for law enforcement due to KYC policies.
• Operation Oracles for Detection: Specialized "Operation Oracles" (classifiers based on unique transaction patterns) enable automated detection and classification of specific malware families' blockchain activities, uncovering previously unknown C2 addresses and operational scale.
• Underestimated Scale of Cybercrime: Advanced blockchain forensics, like the Oracle-driven analysis of DeadBolt ransomware, reveal a massive underestimation of cybercrime's financial gains, with the DeadBolt revenue estimate increasing by 39 times (from 2.8 BTC to 98.3 BTC).
• OP_RETURN as a Data Channel: The OP_RETURN transaction output is a prevalent and effective method for malware to embed small, immutable pieces of data (e.g., encrypted C2 domain names, decryption keys) directly onto the public ledger.
• Disruption Opportunities: Understanding the automated processes of malware interacting with the blockchain (e.g., DeadBolt's key release) can create opportunities for law enforcement to disrupt operations, as demonstrated by the Dutch police's successful recovery of 155 keys.

About the Speaker(s)

Gibran Alberto Gómez Montez is a researcher at the IMDEA Software Institute in Madrid, Spain. His research focuses primarily on blockchain technology, with a particular emphasis on Bitcoin, and its intersection with malware analysis. He presented this work as part of a collaborative research effort with his team members at IMDEA: Juan Cavero, Pedro Moreno, and Kevin Van Liberen. Their work aims to shed light on the sophisticated ways cybercriminals exploit decentralized technologies and to develop advanced analytical tools to counter these threats.