A cybersecurity analyst mapping command-and-control infrastructure behind a state-linked intrusion discovered that roughly 30 operator wallets were using byte-identical smart contracts on a public blockchain to resolve malware C2 addresses, according to research published August 5, 2026 by Yanky Wilson on CSO Online. Two of those wallets appear aligned with nation-state programs, while the remaining 28 resemble standard criminal operations. The research argues that government intelligence services have stopped constructing their own infrastructure and instead lease it from the same criminal marketplace as ordinary crooks, rendering traditional security operations center triage rules obsolete.

Wilson's investigation into an Iranian-linked botnet revealed the tooling was actually a Russian-origin criminal service the actor had purchased rather than developed. Multiple China-linked loader teardowns showed side-loading chains and standard Cobalt Strike shared across both state and criminal operators, with one payload consisting entirely of off-the-shelf Cobalt Strike. Mandiant documented China-linked actors routing operations through contractor-operated relay networks, with IP addresses cycling out in approximately one month and undermining the entire notion of actor-controlled infrastructure. Microsoft and Lumen found Turla, a group tied to Russia's FSB, riding other actors' infrastructure including commodity Amadey bots to deliver backdoors onto Ukrainian military targets, with analysts unable to determine whether Turla paid for the access or simply compromised the criminal control panels. CISA, the FBI, and DC3 documented an Iranian state-linked group functioning as an access broker in the criminal underground, selling initial access to ransomware affiliates while concealing its own nationality from customers.

"A shared kit isn't a weak attribution signal; it's an anti-signal," Wilson writes. "It pools unrelated actors under a single indicator. The more distinctive the fingerprint, the more confidently it groups people who have nothing to do with each other." The analyst notes that any fingerprint written for the blockchain-based C2 kit triggers on all 30 operator wallets and reveals nothing about which one has penetrated a given network. According to the research, the defensible interpretation is a shared supplier with independent customers—two government programs and several dozen criminals sourcing command-and-control tradecraft from the same criminal market, similar to how they might all purchase the same commercial exploit.

The convergence breaks security operations triage because most SOCs route severity based partly on presumed actor identity, whether or not anyone documented the practice. Commodity infostealers on workstations receive tier-one tickets and reimaging, while suspected state activity gets escalated, triggers retainer calls, and launches full threat hunts. That rule assumes tooling correlates with actor, but Amadey—textbook commodity crimeware—delivered an FSB backdoor in Ukraine, and Unit 42 discovered a North Korean state group operating inside a Play ransomware incident. Wilson recommends severing severity from attribution and triaging instead on what the intrusion is doing: access, persistence, staging, exfiltration, and impact are all observable in telemetry, while the operator's nationality isn't visible at the moment analysts must make the call. The research advises anchoring detections on durable constants like event signatures, custom cipher modified constants, and specific side-load chains rather than rotating infrastructure, and capping confidence while documenting attribution uncertainty in writing.

The rented infrastructure won't reveal who's behind an intrusion because it doesn't belong to them, and once analysts stop asking it that question, it becomes far more useful evidence. Wilson has published detection content and on-chain queries from the research on GitHub for defenders to implement. Security teams that continue treating commodity tooling as a de-escalation signal will close intelligence service operations and file them as adware, while those clinging to infrastructure-based attribution will watch their blocklists decay before they finish writing tickets. The gap between how defenders were trained to think and how threat actors now operate has become a structural liability, not just an attribution puzzle. Organizations that adapt their triage rules to observable intrusion behavior rather than presumed actor identity will stop misclassifying state operations as nuisance infections, while those that don't will keep making critical escalation decisions based on signals that pool unrelated adversaries under identical fingerprints.