Elastic Security Labs has uncovered a large-scale KREMLIN malware operation that uses the Ethereum blockchain to update attack infrastructure and malicious browser extensions to steal banking data. Despite the name, researchers found no links to Russia — KREMLIN is the malware author's alias, while the campaign targets Brazilian users of financial services.
Since May 2025, researchers have tracked seven campaigns that infected 1,515 systems, 98.75% of which are located in Brazil. The malware uses Ethereum smart contracts as a "fallback resolver" — infected machines read configuration data from the blockchain to obtain command-and-control server addresses, allowing operators to change their infrastructure without updating the malware itself.
Key operation figures: 1,515 infected systems tracked through a control domain; 98.75% of victims in Brazil; 7 campaigns since May 2025; 82 USDT transactions through the operator's wallet (~20,778 USDT received, ~19,016 USDT sent); 3 Ethereum contracts used for C2 infrastructure.
The first malicious smart contract linked to KREMLIN appeared on Ethereum on May 19, 2026. The contract stored configuration values directing infected systems to the locations of the installer and malicious browser extension. Later contracts changed their structure and moved to a key-value configuration model that the operator could update.
The current contract identified by Elastic — 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b — remained active when the report was published on September 14. Earlier contracts included 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615.
The contracts do not exploit Ethereum's consensus system or smart contract platform. Instead, the attackers use the blockchain as a fallback resolver: infected machines read configuration values from the contracts to locate external infrastructure controlled or used by the operators. This design allows the operators to change infrastructure references by updating on-chain values while leaving the original malware unchanged.
Elastic recorded contract updates pointing to different domains and hosted files, including a change to the main-v2 configuration on August 13. SlowMist issued a threat-intelligence alert on September 16, drawing attention to the blockchain component of the operation, including three Ethereum contracts associated with changes to the command-and-control infrastructure.
KREMLIN's browser component uses a technique that allows an unauthorized extension to appear properly registered inside Chromium-based browsers. The installer modifies Chrome or Edge Secure Preferences data and regenerates the HMAC and encrypted integrity hashes expected by the browser. When these values match, the malicious extension can load even though the user never approved its installation through the official extension store.
This technique predates the KREMLIN campaign. Security firm Synacktiv documented the approach in 2025 in research titled "The Phantom Extension," demonstrating how an attacker with access to a Windows system can modify Chromium preference entries and load an extension through the browser's internal mechanisms. KREMLIN operationalized the technique for financial theft.
How the attack works: JavaScript files are disguised as bank receipts, invoices or corporate documents. When executed by the victim, the loader checks the environment before proceeding to subsequent stages. The AVSync extension requests access to tabs, cookies, browser storage and web requests, collecting stored data and intercepting information during active web sessions.
The extension analyzed by Elastic masqueraded as AVSync software and requested access to tabs, cookies, browser storage and web requests. It could collect stored browser data and intercept information during active web sessions. The malware collects browser databases containing login information, cookies and saved form data. Elastic found that it retrieves the encryption keys needed to access protected browser data before sending the collected information to attacker-controlled infrastructure.
The campaign impersonates major Brazilian banks and financial services:
Portuguese-language filenames, fake error messages and Brazilian financial brands repeatedly appeared in recovered samples, confirming the campaign's geographic focus. Initial infection still requires the victim to execute a malicious file.
Elastic obtained an unusually direct measurement of the campaign's reach after researchers noticed that KREMLIN checked an unregistered internet domain as part of its anti-analysis process. The malware was designed to test whether the domain responded. A successful response caused the program to assume that it was running inside an analysis sandbox and terminate. Elastic registered the previously unused domain and pointed it to infrastructure controlled by the researchers.
Infected machines then began contacting the newly registered address. Elastic counted 1,515 systems at the time of publication, with 98.75% geolocated in Brazil. Researchers said the number was growing rapidly. Registering the domain turned KREMLIN's own anti-analysis check against the campaign. Machines reaching the domain interpreted the response as evidence of a sandbox and stopped progressing through the infection chain.
Elastic cautioned that the intervention was temporary. "This temporarily degraded and manipulated the campaign's defensive mechanisms," the researchers wrote, saying the disruption could give defenders more time to detect and clean infected endpoints. The systems remained infected, meaning that registering the domain did not automatically remove KREMLIN from compromised computers. Elastic's report said infected machines were prevented from progressing beyond the relevant stage of infection while the control point remained effective.
Geographic data: 98.75% of infected systems are located in Brazil. Portuguese-language filenames, fake error messages and Brazilian financial brands repeatedly appeared in recovered samples, confirming Brazil as the campaign's primary target.
The campaign changed its toolset over the course of its lifecycle. Early waves distributed PULSAR RAT, while a newer Ethereum-linked branch introduced REMCOS RAT alongside a custom browser extension. Elastic identified two related chains during this period, including one that uses a legitimate signed SentinelOne executable as part of the loading process.
On-chain analysis helped Elastic connect different stages of the malware operation. Researchers identified a single Ethereum wallet used to deploy the malicious contracts and update their configurations. The address was financially active before the first KREMLIN-linked contract appeared, giving researchers a transaction trail spanning more than a year.
Security teams can use indicators published by Elastic Security Labs and the accompanying public IOC repository to check endpoint, browser and network telemetry for artifacts associated with the campaign. Elastic mapped the activity to MITRE ATT&CK techniques covering execution, persistence, credential access, browser extensions, command and control, and data exfiltration.
Brazilian crypto users were targeted by separate malware distributed through WhatsApp in late 2025. That campaign targeted banking, fintech and cryptocurrency credentials, but was not linked to REF9334. Elastic's latest published blockchain timeline shows that KREMLIN's contract configuration was modified through August, while infrastructure observations extend through late August 2026. Researchers said contract 0xCD7360…d07b remained in use when the September 14 report was prepared.
The use of public blockchains as infrastructure for malware configuration is becoming a recurring pattern. Crypto.news reported in 2025 that malicious npm packages used Ethereum smart contracts to retrieve command infrastructure. ReversingLabs researchers described a comparable model in which blockchain data contained locations used to reach attacker-controlled servers. Microsoft discovered ClickFix campaigns using BNB Chain smart contracts to retrieve malware instructions — a separate campaign, but another example of public blockchains being used as infrastructure for malware configuration.
The KREMLIN operation demonstrates how modern threat actors adapt blockchain technology for operational security, using the immutability and availability of public networks to maintain resilient command-and-control infrastructure that cannot be disabled through traditional domain takedown methods.
“Security is a process, not a product. Threats are constantly evolving, and defenders must adapt faster than attackers.”
— Bruce Schneier, cryptographer and security expert
