Glupteba is a modular, self-updating Windows botnet that uses the Bitcoin blockchain as a fallback command-and-control channel: it reads backup C2 domains from the OP_RETURN field of attacker transactions and decrypts them, making it takedown-resistant. It mines Monero, steals credentials and cookies, and turns hosts and MikroTik routers into proxies. Google's Threat Analysis Group disrupted it and sued its operators in December 2021, but it resurged in 2022. MITRE ATT&CK tracks it as S0457.

Glupteba: The Botnet That Hides Its C2 in the Bitcoin Blockchain

Glupteba is a large, modular, self-updating Windows botnet notable for using the Bitcoin blockchain as a fallback command-and-control channel: when primary C2 domains are unreachable, infected hosts read backup domains encrypted inside the OP_RETURN field of the latest transaction from specific attacker Bitcoin addresses, then decrypt them with hard-coded AES keys. That makes it highly takedown-resistant. It monetises through cryptomining, credential and cookie theft, and deploying proxy components on Windows and IoT devices. In December 2021 Google’s Threat Analysis Group ran a major disruption and filed a lawsuit; the botnet resurged in 2022. MITRE ATT&CK tracks it as S0457.

Overview & Timeline

~2019. The modern modular, blockchain-C2 Glupteba is documented; Google states the blockchain C2 has been used since at least 2019.
Dec 2021. Google’s Threat Analysis Group disrupts the botnet and sues two named Russian nationals.
Jun 2022. Nozomi Networks reports an upscaled resurgence, with expanded Bitcoin-address and Tor C2 usage.

Blockchain C2

Why it survives takedowns

When domain-based C2 is removed, Glupteba reads a backup domain from the latest transaction’s OP_RETURN field on attacker-controlled Bitcoin wallets and decrypts it with a hard-coded AES key. Because the blockchain cannot be seized or filtered like a domain, operators can re-point survivors after a takedown — which Google explicitly anticipated. T1140

Capabilities & Spread

Monetization: XMRig-based Monero mining, browser credential and cookie theft, and turning Windows hosts and routers into resold proxies. T1496 T1539
Distribution via pay-per-install and malvertising bundles (cracked-software and fake-installer lures). T1105
Router exploitation: CVE-2018-14847 in MikroTik RouterOS to turn routers into SOCKS proxies; a reported fleet as large as around 230,000 routers is tied to the associated Mēris botnet, not Glupteba alone. T1190
Lateral spread via EternalBlue with DoublePulsar; persistence via scheduled tasks, service creation and registry run keys, with UAC bypass. T1210 T1053.005 T1548.002

MITRE ATT&CK Mapping (S0457)

Tactic	Technique	Usage
Command and Control	T1140 Deobfuscate/Decode	Blockchain-stored C2 decryption
Persistence	T1053.005 Scheduled Task	System-named binary
Privilege Escalation	T1548.002 Bypass UAC	Elevation
Lateral Movement	T1210 Exploitation of Remote Services	EternalBlue / DoublePulsar
Credential Access	T1539 Steal Web Session Cookie	Cookie theft
Impact	T1496 Resource Hijacking	Monero mining

Google's 2021 Disruption

In December 2021 Google’s Threat Analysis Group, with partners, terminated around 63 million Google Docs used to distribute the malware, plus 1,183 Google accounts, 908 cloud projects and 870 ads accounts tied to distribution, and filed suit against two named Russian nationals. Google assessed the action would materially affect the operation while expecting attempts to regain control via the blockchain backup — which is what followed.

Detection & Mitigation

Monitor for connections to Bitcoin blockchain explorers or P2P nodes from non-crypto endpoints, followed by connections to newly derived domains; watch Tor usage.
Patch MS17-010 and disable SMBv1; update MikroTik RouterOS and restrict Winbox (port 8291) for CVE-2018-14847.
Alert on certutil download abuse and suspicious scheduled tasks; control pay-per-install and malvertising vectors; rotate credentials and invalidate browser sessions on infection.

Detect Takedown-Resistant Botnets

Mjolnir Security helps organisations detect blockchain-C2 botnets and the infections that seed them.

Managed Detection & ResponseThreat HuntingEgress MonitoringIncident ResponseEndpoint Hardening

Managed Detection and Response Monitoring for blockchain-C2 retrieval, certutil abuse and cryptomining behaviour.
Threat Hunting as a Service Hunting for pay-per-install footholds and router-proxy compromise.
24/7 Incident Response Containment when botnet activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026