A new botnet dubbed “Orchard” has been discovered by 360 Netlab researchers. The standout feature is the ability to generate new command-and-control (C2) domains using Bitcoin transactions. Domain Generation Algorithms (DGAs) have been present in botnets for years; they allow the botnet to change C2 domains without communication between the victim machine and the C2 server, preventing defenders from discovering the new domain name. Most botnets use a time-based algorithm to generate the new domains; this input enables researchers to predict and discover domains before they are used. Orchard instead uses a Bitcoin address’s information to generate the domain name. To do this, it makes an HTTP request to the blockchain.info API with the “Genesis” Bitcoin wallet address of Satoshi Nakamoto, the creator of Bitcoin. This particular address is sent a small amount Bitcoin every few days for various reasons. This creates a variable input that cannot be predicted. While Orchard’s main goal is to mine cryptocurrency on the affected systems, it is still under active development and its purpose could change. CTIX analysts are continuing to monitor the development of this botnet and will update for any new developments.