Blockchain-assisted cyberattacks surge fivefold, driven by Iranian and North Korean state actors, Russia-linked groups

Blockchain-assisted cyberattacks have risen more than fivefold since last year, driven largely by North Korean and Iranian nation-state actors and Russian-speaking criminal groups, according to a report by blockchain data and intelligence platform Chainalysis. Rather than storing malicious payloads on servers that are susceptible to disruption, the attackers store them on public, censorship-immune blockchains. The technique, named Blockchain Dead Drops (BDD), stores payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand.

What makes BDD particularly dangerous is that it gives cyberattack campaigns unprecedented durability. Because blockchain data is public, immutable, and replicated worldwide, takedowns become immensely difficult. Threat actors can use this resilient infrastructure for command and control without worrying about losing the layer to domain seizures, repository removals, hosting takedowns, and additional disruptions.

The report notes that the widespread availability of Chinese open-source AI tools has significantly lowered the technical barrier to entry for cybercrime. …