Graphalgo blockchain dead-drop C2 via Arbitrum Sepolia smart contract calls

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•1

Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.