Blockchain security company SlowMist has issued an urgent warning about a sophisticated supply chain attack targeting users of the Ethereum ecosystem. The alert follows the discovery of malicious modifications in the software packages of Ethersphere, which is a core component within Swarm, a decentralized storage network operating on Ethereum.
Compromised Software Detected
On X, the social media platform, SlowMist reported that hackers successfully infiltrated GitHub accounts associated with Ethersphere. Leveraging the official software release process, attackers managed to distribute compromised versions of Swarm’s software to the community.
The malware is capable of affecting operating systems across Windows, macOS, and Linux, raising concerns over its wide-ranging impact. Ethersphere’s Swarm software, designed to provide decentralized file storage and content distribution within Ethereum, has become a prime target for such attacks.
Security analysts highlighted that by using these infected releases, hackers could gain unauthorized access to cryptocurrency wallets, steal private keys, and maintain a persistent backdoor on impacted devices. This could compromise user security and potentially lead to significant financial losses.
Security experts have cautioned that malicious software within these releases could jeopardize wallet credentials, expose private keys, and provide attackers a permanent access route into users’ systems.
Ethereum Smart Contracts as Command Center
Beyond traditional malware distribution, the attackers have employed an innovative tactic by utilizing an Ethereum smart contract as part of their infrastructure. This contract serves as a decentralized command-and-control (C2) configuration mechanism, allowing cybercriminals to update remote server addresses controlling the malware at any time, without needing to redeploy the infected software.
This method not only complicates efforts to neutralize the threat but also expands its potential reach within the decentralized ecosystem. The tactic leverages the immutable and distributed nature of smart contracts on blockchain networks for maintaining control over malicious operations.
Mini dictionary: Command-and-control (C2) configuration repository – A method used by attackers to manage malware remotely, often through encrypted or decentralized infrastructure to evade detection and maintain operational flexibility.
SlowMist disclosed that attackers used an Ethereum smart contract as the decentralized nerve center for managing the malware, granting them the ability to modify active server addresses dynamically without pushing a new malicious build.
Further analysis revealed that the same smart contract had links to previous malware campaigns named SleepyDuck and EtherDuck. Those operations reportedly targeted developers through malicious extensions available in the Open VSX marketplace.
This recurring use of a specific smart contract suggests the ongoing nature of attempts to exploit the Ethereum and Swarm developer communities.
Industry Response and User Precautions
Independent security experts from Socket and SafeDep teams corroborated SlowMist’s findings, identifying malware designed to steal Swarm wallet data and deploy persistent remote access tools on compromised devices.
Following these discoveries, SlowMist urged all potential victims and users of the affected Swarm package to immediately uninstall the compromised software and revert to the known clean version, 13.2.0. For those using Swarm Desktop version 0.56.2, updating to the secure release, v0.56.3, was also strongly recommended.
| Software | Compromised Version | Safe Version |
|---|---|---|
| Swarm package | Latest (post 13.2.0) | 13.2.0 |
| Swarm Desktop | v0.56.2 | v0.56.3 |
The guidance emphasizes swift action to prevent further compromise, as attackers continue to leverage advanced blockchain-integrated methods to target cryptocurrency users and developers.
