One C2 Kit, 30 Customers, Two Governments: How Criminal Infrastructure Is Hiding State Hackers
A security researcher traced a single command-and-control tool to roughly 30 separate operators, including two with suspected government ties. The finding breaks a core assumption most security teams quietly rely on every day.
Key points
- A researcher tracking state-linked hackers found the same command-and-control kit, meaning the software criminals use to remotely control infected computers, in use by approximately 30 separate groups, including two suspected government programs.
- The kit's instructions were hidden inside a public blockchain, a shared digital ledger normally associated with cryptocurrency, making them difficult to block.
- Groups linked to Russia, China, Iran, and North Korea have all been documented using off-the-shelf criminal tools rather than building their own.
- Standard security triage, which often escalates suspected government attacks above ordinary crime, no longer works reliably when both use identical software.
- Researchers from Mandiant, Microsoft, Lumen, and CISA have independently reached the same structural conclusion from entirely different angles.
A researcher mapping the hidden computer networks that malicious software uses to receive instructions hit an unexpected result. The malware they were studying fetched its orders by reading a smart contract, which is a small self-running program stored on a public blockchain. That is unusual. What came next was more so.
Pulling on that thread, the researcher found not one contract but a family of roughly two dozen byte-identical copies, all produced by the same builder and driven by approximately 30 separate operator wallets. Two of those wallets carried markers that other researchers had independently linked to government programmes. The remaining 28 looked like plain criminal operations.
"I went in looking for an actor's infrastructure," the researcher wrote, in an analysis first covered by CSO Online. "What I found was a product with a customer list."
Why does this matter to anyone outside a security team?
It matters because of how security teams decide which alerts to treat as urgent.
Most organisations, whether they have written it down or not, treat suspected government hacking as a higher-priority emergency than ordinary cybercrime. That decision makes sense in principle. It falls apart when both groups are running identical software bought from the same criminal supplier.
Consider two cases the researcher cites. Amadeu, a well-known piece of low-cost malware that most analysts would file under routine crime, turned out to be the delivery vehicle for a backdoor linked to Russia's FSB intelligence service on targets in Ukraine. Separately, security firm Unit 42 found a North Korean state group operating inside a ransomware incident carried out by a criminal group called Play.
If your rule is "cheap crimeware equals low priority", you may have just quietly closed an intelligence operation.
What are governments actually doing?
The picture varies, but the destination is the same.
| Country link | Documented behaviour | Source |
|---|---|---|
| Russia (Turla/FSB) | Rode other criminals' infected machines to reach Ukrainian military targets | Microsoft / Lumen reporting |
| China-nexus groups | Routed operations through contractor-run relay networks; used stock Cobalt Strike | Mandiant |
| Iran | Sold stolen network access to ransomware criminals while hiding its own identity | CISA / FBI / DC3 advisory |
| North Korea | Operated inside a criminal ransomware case; bought C2 services under sanctions pressure | Unit 42 |
Iran and North Korea buy criminal tools because sanctions cut them off from commercial alternatives. China subcontracts to a domestic contractor industry built for the purpose. Russia largely takes access from criminal groups already present, sometimes by paying, sometimes by simply breaking into their own control panels. Microsoft's analysts reportedly could not determine which method Turla used in one documented case. When professionals cannot tell purchase from theft, the idea that you can trace a nationality from software alone is finished.
What should security teams actually change?
Three practical shifts, none of which require new tools.
First, stop letting assumed identity drive urgency. Triage on what the intrusion is doing: is it establishing persistence, moving through the network, staging data for removal? Those are observable facts. The attacker's nationality is not, at the moment you need to act.
Second, treat cheap, common tooling as a neutral signal on any machine that matters. It no longer means low stakes.
Third, anchor your detection rules on the things that do not change when a criminal rents new infrastructure. A server address rotates. A relay node cycles roughly monthly. A specific custom encryption constant, a distinctive loading chain, a particular event signature: those survive. Build detections there, and accept that the same rule will fire on a government operation and an opportunistic teenager alike.
The infrastructure was never going to tell you who the attacker is. It is not theirs.
Common questions
Could ordinary businesses be caught up in this?
Yes. Criminal tools used by state groups hit the same targets ordinary ransomware hits: businesses, hospitals, schools. If your network is worth breaking into, the tool used against you may come from the same kit as one used against a government.
Is there anything individuals can do?
The structural problem sits with defenders and vendors, not individuals. That said, any employee who can spot a phishing email, where criminals send fake messages to trick staff into handing over access, removes one of the most common ways any of these tools arrive in the first place.
