I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server."

"There's no hosting provider to contact, no registrar to pressure, no infrastructure to shut down. The Solana blockchain just... exists. "

Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage.

"Connections to Solana RPC nodes look completely normal. Security tools won't flag it. "

Then your security tools are badly configured. Lots of crypto traffic should be treated as a red flag in almost any corporate environment.

"there's literally no way to take it down"

There is, you just have to accept that Solana goes down with it. Why is A-OK in a work environment.