CryptoSlate reports that hackers increasingly use public blockchains to keep malware online after traditional infrastructure is shut down. Citing Chainalysis on September 18, 2026, it reports a 440% jump in malicious blockchain writes in less than a year, with North Korea- and Iran-linked groups accounting for roughly two-thirds of newly observed activity each quarter. Crypto.news, also citing Chainalysis that day, reports a 420% rise in onchain malware activity over the preceding year and attributes roughly two-thirds of newly identified activity each quarter to state-backed hackers.