Search This Blog
Load More
Trendy Right Now

Popular Posts

Showing posts with label Bitcoin. Show all posts
Windows
Bitcoin Browser cryptocurrency Cyber Crime Google Chrome Phylum Threat actors Typosquatting Windows

Clipper Virus: 451 PyPI Packages Deploy Chrome Extensions to Steal Crypto


Threat actors have recently released more than 451 distinct Python packages on the official Python Package Index (PyPI) repository in an effort to infect developer systems with the clipper virus. 

The libraries were discovered by software supply chain security firm Phylum, which said the ongoing activity is a continuation of a campaign that was first made public in November 2022. 

How Did Threat Actors Use Typosquatting? 

In an initial finding, it was discovered that popular packages including beautifulsoup, bitcoinlib, cryptofeed, matplotlib, pandas, pytorch, scikit-learn, scrapy, selenium, solana, and tensorflow were being mimicked via typosquatting. 

For each of the aforementioned, the threat actors deploy between 13 and 38 typosquatting variations in an effort to account for a wide variety of potential mistypes that could lead to the download of the malicious package. 

In order to evade detection, the malicious actors deployed a new obfuscation tactic that was not being utilized in the November 2022 wave. Instead, they are now using a random 16-bit combination of Chinese ideographs for function and variable identifiers. 

Researchers at Phylum emphasized that the code makes use of the built-in Python functions and a series of arithmetic operations for the string generation system. This way, even if the obfuscation produces a visually striking outcome, it is not extremely difficult to unravel. 

"While this obfuscation is interesting and builds up extremely complex and highly obfuscated looking code, from a dynamic standpoint, this is trivial[…]Python is an interpreted language, and the code must run. We simply have to evaluate these instances, and it reveals exactly what the code is doing,” reads a Phylum report. 

Malicious Browser Extensions 

For taking control of the cryptocurrency transactions, the malicious PyPi packages create a malicious Chromium browser extension in the ‘%AppData%\Extension’ folder, similar to the November 2022 attacks. 

It then looks for Windows shortcuts pertaining to Google Chrome, Microsoft Edge, Brave, and Opera, followed by hijacking them to load the malevolent browser extension using the '--load-extension' command line argument. 

For example, a Google Chrome shortcut would be hijacked to "C:\Program Files\Google\Chrome\Application\chrome.exe --load-extension=%AppData%\\Extension". 

After the web browser is launched, the extension will load, and malicious JavaScript will monitor for cryptocurrency addresses copied to the Windows clipboard. When a crypto address is found, the browser extension will swap it out for a list of addresses that are hardcoded and under the control of the threat actor. By doing this, any sent cryptocurrency transaction funds will be sent to the wallet of the threat actor rather than the intended receiver. 

By including cryptocurrency addresses for Bitcoin, Ethereum, TRON, Binance Chain, Litecoin, Ripple, Dash, Bitcoin Cash, and Cosmos in this new campaign, the threat actor has increased the number of wallets that are supported. 

These findings illustrate the ever-emerging threats that developers face from supply chain attacks, with threat actors inclining to methods like typosquatting to scam users into installing fraudulent packages.  

Read more »
Cyber Security
AI AI Crypto Bitcoin ChatGPT cryptocurrency Cyber Security

How ChatGPT Could Drive A Viral Crypto Narrative


AI Crypto: The next big thing 

AI crypto tokens will surely be the next big thing in the industry, an image of Metaverse mania, Defi boom, or meme coin explosion. 

ChatGPT and other AI-based technologies have been viral across social media and the business world. Will this make three altcoins stand-out winners in the next bull market?

Understanding AI Crypto: How trading narratives can bring profit

Narratives are important for incredible rallies or declines, does not matter if they are accurate or not. For instance, the last Bitcoin narrative was aggravated by its use as an inflation hedge. But when the inflation hedge surfaced, the top cryptocurrency was hit by one of its worst downtrends to date. 

Other latest narratives include Defi driving Ethereum and similar coins higher, or when Metaverse tokens rose rapidly after Mark Zuckerberg changed the parent company's name to Mera (earlier Facebook). 

NFTs also helped Ethereum and newbies like Solana. Elon Musk made meme coins go viral by just tweeting about it.

The one thing common in all these assets is that the narratives made money while being in markets, it is all that matters. For savvy cryptocurrency investors exploring the next big narrative, you don't have to look beyond two letters: AI.

AI Crypto and ChatGPT

OpenAI's ChatGPT is currently all over social media. The AI tool has already passed the Medical License Exam, Bar Exam, and MBA exam. People are using it to write articles, solve questions, and tweets, do homework, and perform tasks automatically. People are even using it for Bitcoin as various celebrities. The platform has shown sheer potential. 

Crypto AI Tokens on the edge of a new "Bull Cycle"

Although no AI crypto tokes share any resemblance with ChatGPT, projects with links with anything AI has recovered more significantly from cryptocurrency bear market lows.

For instance, Fetch.ai(FET), is up roughly 480% from its lows and is up over 200% in January 2023 itself. Ocean Protocol (OCEAN) is another great example, with a 230% recovery from lows and more than 100% year-to-date. SingularlyNet (AGIX) beats them both with a low put in three months before and more than 600% gains from the low. AGIX jumped over 460% during January 2023 with a full week still left. 

The results are surprising, but there's still a lot more to see. Jason Soni, Crypto and Currency Analyst at Elliott Wave International recently made a video on three AI-based crypto tokens that may be on the verge of a new bull cycle. 

The three cryptocurrencies analyzed in the video are AGIX, FET, and OCEAN. You can find Soni's analysis on Elliott Wave international's Crypto Trader's Classroom, which brings three new videos every week. The video explains where these altcoins are in their current market cycle and breaks down why there could be more upside in the future. 



Read more »
North Korea
Bitcoin cryptocurrency Cyber Security Cyberattacks FBI Hackers Harmony Bridge Lazarus Groups North Korea

A $100 Million Theft Has Been Attributed to the Lazarus Group by the FBI

 


A $100 million cryptocurrency heist was committed by the Lazarus Group last June, which has been blamed by the FBI for the crime. Known for stealing cryptocurrency to help support the military and weapons programs of the North Korean government, this team is associated with the North Korean government. 

A statement released by the FBI on Tuesday identified Lazarus Group, which is also known as APT38, as the perpetrators of the June 24 attack on the Harmony Horizon bridge. The FBI released this information. In the course of this attack, $100 million worth of Ethereum was lost. Harmony Horizon is a bridge that allows you to connect Ethereum, Bitcoin, Binance Chain, and Harmony with the aforementioned cryptocurrency systems. The Ethereum bridge was accessed by attackers in June of this year and the cryptocurrency was stolen. 

There has been a reported theft on the Horizon bridge this morning for approximately $100MM, which was discovered by the Harmony team. At the time of the incident, Harmony said that they had begun to work with national authorities and forensic specialists to identify the perpetrator. In addition, they had begun to regain the funds that had been stolen. 

As a team, the FBI and the Department of Justice's National Cryptocurrency Enforcement Team have combined to investigate the Harmony heist, as well as several United States attorneys' offices. Earlier this week, the FBI announced that the Lazarus Group had been responsible for the attack and used its malware tool TraderTraitor as part of its operation. This malware was one of the components of the attack. 

"During the June 2022 heist, North Korean cyber actors, who used an encryption protocol known as Railgun, a privacy protocol, gained access to over $60 million worth of Ethereum (ETH) that had been stolen. It is believed that a portion of the stolen Ethereum from this theft was sent to several virtual asset services for conversion into bitcoin (BTC)," the FBI said in a statement released by the bureau. 

Lazarus Group is a North Korean security firm that has been active for several years. It is closely associated with the North Korean government and typically pursues the interests of the government. A successful attack by this group on the Bank of Bangladesh in 2016 netted it $81 million. Since then, Lazarus has continued to operate against banks and crypto exchanges to fund its operations. 

Lazarus Group is a group of companies that specialize in penetrating cryptocurrency firms and exchanges, as well as other targets. This is done with the use of their tools that are integrated into TraderTraitor. Oftentimes, these tactics begin when hackers send phishing emails to employees at a target company. They entice them to download malicious files in the hopes that they will be able to decipher what they are downloading. 

Many of these messages are disguised as recruitment efforts and offer high-paying jobs to entice recipients to download cryptocurrency applications laced with malware, also known as TraderTraitor by the U.S. government, according to a CISA advisory released in April. 

TraderTraitor is the term used to describe a series of malicious applications that are written using cross-platform JavaScript and run on the Node.js runtime running on Electron using the Node.js runtime environment. Several malicious open-source applications have been downloaded into the system, posing as tools that can help traders or price forecasters trade cryptocurrencies. TraderTraitor campaigns promote the alleged features of the applications on websites with modern designs. 

Several intrusions carried out by the Lazarus Group have used TraderTraitor as part of their investigations, and they have been quite successful in doing so. There was also another tool they used, a macOS backdoor called AppleJeus, which they implemented along with more advanced ways. 

In addition to spreading cryptocurrency trading applications modified to contain malware that facilitates cryptocurrency theft, the Lazarus Group also distributed AppleJeus trojanized cryptocurrency applications targeting individuals and companies, including cryptocurrency exchanges and financial services firms. 

According to the advisory, the North Korean regime will likely continue to exploit the vulnerabilities of cryptocurrency technology companies, gaming companies, and exchanges. This will enable it to generate and launder funds to support its regime. 

During the Harmony intrusion, the Lazarus Group moved bitcoin to several exchanges, which the FBI worked with to freeze those assets.
Read more »
python
Bitcoin Crypto Ethereum Hackers Malicious actor malware NPM Package PyPI Package python

An Active Typosquat Attack in PyPI and NPM Discovered

The typosquatting-based software supply chain threat, which targets explicitly Python and JavaScript programmers, is being warned off by Phylum security researchers.

What is Typosquatting?

Cybercriminals that practice typosquatting register domains with purposeful misspellings of the names of popular websites. Typically for malevolent intentions, hackers use this tactic to entice unwary users to other websites. These fake websites could deceive users into inputting private information. These sites can seriously harm an organization's reputation if attacked by these perpetrators. 

PYPI &NPM

Researchers alerted developers to malicious dependencies that contained code to download Golang payloads on Friday, saying a threat actor was typosquatting well-known PyPI packages. 

The Python Software Foundation is responsible for maintaining PyPI, the largest code repository for the Python programming language. Over 350,000 software programs are stored there. Meanwhile, NPM, which hosts over a million packages, serves as the primary repository for javascript programming. 

About the hack

The aim of the hack is to infect users with a ransomware variant. A number of files with nearly identical names, like Python Requests, are being used by hackers to mimic the Python Requests package on PyPI.

After being downloaded, the malware encrypts files in the background while changing the victim's desktop wallpaper to a picture controlled by the hacker, and looks like it came from the CIA.

When a Readme file created by malware is opened, a message from the attacker requesting $100, usually in a cryptocurrency, for the decryption key is displayed. 

The malware used is referred to as W4SP Stealer. It is able to access a variety of private information, including Telegram data, crypto wallets, Discord tokens, cookies, and saved passwords. 

One of the binaries is ransomware, which encrypts specific files and changes the victim's desktop wallpaper when executed. However, soon the malicious actors published numerous npm packages with identical behaviors. For the decryption key, they demand $100 in Bitcoin, XMR, Ethereum, or Litecoin.

Each of the malicious npm packages, such as discordallintsbot, discordselfbot16, discord-all-intents-bot, discors.jd, and telnservrr, contains JavaScript code that acts identical to the code embedded in the Python packages. 

Louis Lang, chief technology officer at Phylum, predicts a rise in harmful package numbers. These packages drop binaries, and the antivirus engines in VirusTotal identify these binaries as malicious. It is advised that Python and JavaScript developers adhere to the necessary cybersecurity maintenance and stay secure. 



Read more »
Technology
Bitcoin cryptocurrency Growing cybercrines Technology

Growing Cyberattacks on Cryptocurrency

Cybercrimes against cryptocurrencies continue to soar and pose a primary threat to giant institutions of cryptocurrencies, individuals, and governments worldwide. The whole world talks about bitcoin, cryptocurrencies, and blockchain technology, however, no one seems to talk about the high probability of loss and cyber threats. 

In the first half of 2022, malicious actors have successfully captured nearly $2 billion worth of cryptocurrencies, a 60% rise from last year. There are various reasons why cryptocurrencies are attacked by cybercriminals, often and extensively. 

SonicWall published a report that disclosed that cryptojacking and ransomware attacks had dropped in the latter half of 2019. Cyber intelligence further added that the drastic drop in the number of crypto-jacking cases happened because of the closing down of Coinhive. However, it led cyber attackers to turn to more targeted attack vectors with an increase in specialized malware attacks to steal digital currencies. 

While some cybersecurity organizations are showing their interest in slowing down the crypto market would lead to a slowdown in cybercrime, this is not possible, and the risks and threats associated with it will remain high. Even some trends indicate that the crypto-crime problem may grow worse in the coming years. 

According to the technical data, cryptocurrency exchanges, personal wallets, and platforms are primary targets of cryptohackers since they deal in large volumes of virtual money. The research shows that from June 2021 to June 2022, crypto platforms witnessed a loss of an estimated amount of $44 billion. 

Cyberthreats exploited unsecured wallets, SIM card jacking, and stealing recovery phrases and passwords. Furthermore, the profile of the cyber incident shows that cryptocurrency ATMs are currently targeted by cryptohackers. There were approximately 1,500 cases of crypto ATM fraud last year reported in which hackers captured $28 million, said the FBI. 

Nevertheless, reports also confirmed that State-sponsored cryptohackers regularly target crypto firms and the stolen money is being funded for financing terrorist activities and war crimes. Cryptocurrency is also the de facto currency of the Dark Web, where virtual currency is traded for various illicit activities. 

How can you protect your system and your funds from being compromised? 


  • Educate yourself and your workforce about the threats and methods of protecting your system. 
  • It is always advisable to do business with exchanges and marketplaces that follow proper regulations and security practices. 
  • Organizations should follow multi-layered defense protection and have the proper technical defenses in place when it comes to emergencies because cyberattacks can impact even the most security-savvy organizations.
Read more »
Technology
Binance Bitcoin Blockchain China Crypto Currency Digital Asset HahKey Fintech FTX Hong Kong Singapore Technology

Hong Kong Will Legalize Retail Crypto Trading to Establish a Cryptocurrency Hub

 


A plan to legalize retail cryptocurrency trading has been announced by Hong Kong to create a more friendly regulatory regime for cryptocurrencies. There has been an opposite trend over the last few years in the city, with skeptical views, as well as China's ban on the practice. 

According to sources familiar with the matter, an upcoming mandatory licensing program for crypto platforms scheduled to take effect in March next year will allow retail traders access to crypto platforms. There has been a request not to name these people since they are not authorized to release this information publicly.

There have been reports that the regulators are planning to allow the listing of higher-value tokens in the coming months but will not endorse specific coins such as Bitcoin or Ether, according to the people. They noted that the details and timeframe are yet to be finalized since a public consultation is due first.

At a fintech conference that starts on Monday, the government is expected to provide more details regarding its recently announced goal of creating a top crypto hub in the region. To restore Hong Kong's reputation as a financial center after years of political turmoil and the aftermath of Covid curbs sparked a talent exodus, the marketing campaign comes amid a larger effort to put Hong Kong back on the map.

Gary Tiu, executive director at crypto firm BC Technology Group Ltd, said that, while mandatory licensing in Hong Kong is one of the most effective things regulators can do, they cannot forever satisfy the needs of retail investors who are investing in crypto assets. 

Criteria for listing 

According to people familiar with the matter, the upcoming regime for listing tokens on retail exchanges is likely to include criteria such as the token's market value, liquidity, and membership in third-party crypto indexes to determine eligibility for listing. Their approach resembles the one they used when it came to structured products such as warrants, they continued. 

Hong Kong's Securities and Futures Commission spokesperson did not respond to a request for comment regarding the details of the revised stance adopted by the agency. 

Several crypto-related Hong Kong companies that are listed on the stock exchange increased their share prices on Friday. In the same report, BC Technology climbed 4.8% to its highest in three weeks during the third quarter, whilst Huobi Technology Holdings Ltd. rose slightly. 

In a world where more and more regulators are grappling with how to manage the volatile area of digital assets. This area has gone through a $2 trillion rout, following a peak in early November 2021. The sector is finding it difficult to regain its previous strength. Firms that dealt in cryptocurrency were crushed by the crash because their leverage grew without limit and their risk management methods were exposed.

It is widely believed that Singapore has tightened up its digital-asset rules to curb retail trading in digital assets to deal with the implosion that has hit Hong Kong. 

There was a proposal earlier this week by Singapore to ban the purchase of leveraged retail tokens on the retail market. There was a ban on cryptos in China a year ago because it was largely illegal. 

Michel Lee, executive president of digital-asset specialist HashKey Group, said that Hong Kong is trying to frame a crypto regime that extends beyond the retail token trading market to incorporate all types of digital assets, including cryptocurrencies. 

Bringing the ecosystem to the next level 

Among other things, Lee believes that tokenized versions of stocks and bonds could become a much more significant segment in the future as time passes on. Lee said, "Just trading digital assets on its own is not the goal". According to Lee, digital assets are not intended to be traded on their own but the ecosystem must grow as quickly as possible.”

A big exchange such as Binance and FTX once had their base in Hong Kong. Their attraction was the reputation of a laissez-faire regime and their strong ties to China. A voluntary licensing regime, that was introduced by the city in 2018, limited crypto platforms' access to clients with portfolios exceeding HK$8 million ($1 million) to those with portfolios of less than that amount. 

It has been confirmed that only two firms have been approved to operate under the license, BC Group and HashKey. FTX successfully managed to turn away the more lucrative consumer-facing business to the Bahamas last year as a result of the signal of a tough approach. 

However, the plan to attract crypto entrepreneurs back to Hong Kong seems to be a bit short of what is needed to usher them back. Among other things, it remains to be seen if mainland Chinese investors would be able to trade in tokens through Hong Kong if that were to be permitted. 

Leonhard Weese, the co-founder of the Bitcoin Association of Hong Kong, expressed a fear that there might be a very strict licensing regime in the future. "The conversations I have had indicate that people still fear it will be very stressful," he said. The company claims that it is not competitive on the same level as overseas platforms. Therefore, it will not be as attractive to customers as it would be if it dealt directly with retail users. 

According to blockchain specialist Chainalysis Inc., the volume of digital-token transactions in Hong Kong through June declined less than 10% from a year earlier, the most modest increase in the region outside of a slump in China, in the 12 months through June. It has fallen two positions from its global ranking of 39 in 2021 to 46 in 2022 when it comes to crypto adoption throughout the city. 

The Securities and Futures Commission of Hong Kong's Fintech Department has also suggested that the city could take further steps in this area, including the establishment of a regime to authorize exchange-traded funds seeking exposure to mainstream virtual assets. 

It shows that the one country, two systems principle is being put into action in financial markets, Wong said at an event last week. He said that the fact that the city can introduce a cryptocurrency framework distinct from China's indicates how far it has come.
Read more »
Technology
Bitcoin Conference Crypto Accord Crypto Currency Digital Currency. Technology

E1 Salvador Hosting Promotional conference "Adopting Bitcoin"

 



The first nation to embrace bitcoin as authorized cash in the year 2021 is El Salvador. There is no evidence in recent years that suggest that the country El Salvador will renounce crypto accord. The country will be hosting the conference “adopting Bitcoin” which will aim to encourage the adoption of 
Bitcoin. 

The conference “Adopting Bitcoin” will include an examination of technology and financial inclusion will be done. Approximately 110 speakers will be joining from 30 countries, one of the notable personalities is Senator India Kempis of Mexico.

In the 3rd week of November from 15th to 17th, the Bitcoin Beach conference will take place in San Salvador and the surrounding area. There is no event like the Bitcoin Conference that brings together the entire Bitcoin ecosystem for the purposes of collaboration, networking, and education.

E1 Salvador hosting a crypto-adopting conference

Bitcoin Beach Wallet, a bitcoin wallet developed and operated by Galoy Inc., is being rolled out in El Salvador through the platform that powers Bitcoin Beach Wallet. The bitcoin exchange Bitfinex will also be the primary sponsor of the event, which is taking place in November. In order to develop a financial technology platform for the issuance and trading of Volcano Tokens, Bitfinex is collaborating with the government of El Salvador to create a platform that will be used by both parties throughout the process.

It was impossible to have anticipated in 2021 that a sovereign government would be using Bitcoin as their official legal tender. A significant shift was observed in the public's perception of the nation as well as its currency as a result of the action. Currently, El Salvador is making progress on its way to becoming one of the first financial inclusion models in Central America and becoming the Singapore of Central America.

Nonetheless, Bitcoin has proven to be a very convenient exchange medium that can support millions of transactions each day, proving to be a very successful exchange medium. This conference will take place at the Crowne Plaza convention center in Orlando, Florida over the first two days. During the presentation, speakers will discuss the most recent advancements in the Bitcoin ecosystem from a technological and economic perspective.

Among the most significant presentations of the conference will be that of the Bitcoin Core engineer Jon Atak. Atak recently won a $50,000 grant from the Human Rights Foundation, and his presentation will be an important contribution to the technology field.

Another significant speaker at the economic conference will be Senator Indira Kempis of Mexico who is scheduled to deliver the keynote address. Kempis is known in the past for her advocacy for central bank digital currencies (CBDCs), which have been in the news for quite some time. Her effort to legalize bitcoin in Mexico, which made headlines globally, was another remarkable achievement. 

The Crypto Environment After Conference


The cryptocurrency market is presently undergoing a turbulent phase. As far as market conditions are concerned, the current market environment is by far the most severe crypto winter in history. As risk assets declined overnight, bitcoin (BTC) reached new weekly lows on September 28 as the price declined throughout the entire week.

There is a strong correlation between the value of digital currencies and the stock market in the U.S., which has prompted investors to pay close attention to monetary policy for this year. There has been a surge in interest rates along with pressure applied to the S&P 500 and the tech-heavy Nasdaq, which has influenced other risky assets, such as cryptocurrencies, as well as others in general.

As a result of this year's interest rate hikes, the United States Federal Reserve has not made any commitments to stop them yet, although this year's rate hikes have exerted pressure on risk assets such as cryptocurrency in general.

At the same time, investors are closely watching the U.S. dollar in order to determine how it will perform. It has been estimated that the dollar index, which measures how the greenback is performing against a basket of currencies, has increased by more than 18% so far this year. 
Read more »
Flaws
Bitcoin Bugs Crypto cryptomining Cyber Attacks Flaws

TeamTNT is Back & Targets Servers to Run Bitcoin Encryption Solvers

 

AquaSec threat analysts have detected TeamTNT activity on their honeypots since early September, leading them to believe the infamously hacking group is back in business. 

TeamTNT announced its retirement in November 2021, and most associated observations since then have involved remnants of previous infections, such as automated scripts, but no new payloads. The recent attacks, however, bear various signatures associated with TeamTNT and rely on tools previously deployed by the gang, indicating that the threat actor is likely making a comeback.  The researchers observed three attack types utilized in the reportedly new TeamTNT attacks, the most intriguing being the use of hijacked servers' computational power to run Bitcoin encryption solvers.

The attack, dubbed "the Kangaroo attack" because it employs Pollard's Kangaroo WIF solver, scans for vulnerable Docker Daemons, deploys an AlpineOS image, drops a script ("k.sh"), and eventually retrieves the solver from GitHub. Pollard's Kangaroo interval ECDLP (Elliptic Curve Discrete Logarithm Problem) solver algorithm attempts to decipher the SECP256K1 encryption used in Bitcoin's public-key cryptography.

“It [the algorithm] is designed to run in a distributed fashion since the algorithm breaks the key into chunks and distributes them to various nodes (attacked servers), collecting the results which are then written locally to a text file,” explains AquaSec.

While quantum computing is expected to break existing Bitcoin encryption at some point in the future, it is thought to be impossible to achieve with current machines, TeamTNT appears willing to test the theory anyway, using other people's resources.

Perhaps the threat actors are simply experimenting with new attack pathways, payload deployment, and evasion while performing intensive operations on captured systems, with the Kangaroo attack ticking all of the boxes.

Other Attacks

Other attacks detected by AquaSec are similar to previous TeamTNT operations but have some new characteristics.

The "Cronb Attack" employs well-documented rootkits, cron jobs for persistence, cryptominers for profit, and lateral movement tools. The appearance of new C2 infrastructure addresses and more elaborate data exchange is the novel element.

The "What Will Be" attack targets Docker Daemons with shell-file dropping Alpine images once more, taking advantage of a vulnerability to escape from the container to the host. The attackers then download and execute additional scripts, rootkits, and a cryptominer, as well as add cronjobs and perform network SSH scans.

These scripts introduce a new trick in this attack, allowing threat actors to optimise crypto mining performance by modifying CPU model-specific registers. Whether it is TeamTNT or someone else carrying out these attacks, organisations should strengthen their cloud security, strengthen Docker configuration, and implement all available security updates before it is too late.

Read more »
Unauthorized
Bitcoin Crypto Data Breach DeFi FBI Open Source System Unauthorized

FBI: Hackers use DeFi Bugs to Steal Cryptocurrency

 


Investors are being warned by the FBI that hackers are increasingly using Decentralized Finance (DeFi) platform security flaws to steal cryptocurrency.

According to the PSA, which was posted on the FBI's Internet Crime Complaint Center (IC3) today, nearly 97% of the $1.3 billion in bitcoin that was stolen between January and March 2022 came via DeFi sites. This represents a big increase from 72% in 2021 and roughly 30% in 2020, according to projections by the FBI.

The FBI urges people to be aware of the hazards, seek professional assistance if they are unsure, and research the security and general business practices of DeFi providers. Additionally, we all refer to DeFi providers as exchanges, markets, and other websites where you may buy, sell, trade, and borrow bitcoins and other digital assets.

The FBI's warning is due to a Chainalysis analysis from April that revealed how, per Q1 2022 statistics, DeFi cryptocurrency platforms are currently more targeted than ever.

In the majority of occurrences, the hackers rely on using security flaws in their platform's code or unauthorized access to drain cryptocurrency to addresses under their command.

According to Chainalysis, the threat actors responsible for these attacks used dangerous laundering services, like unlawful exchanges and coin tumblers on the dark web, to re-launder the majority of the stolen funds in 2022.

The FBI's alert provides investors with guidance that begins with basic cautions about performing due diligence before investing and then suggests the following:

Before investing, research DeFi platforms, protocols, and smart contracts and be aware of the dangers associated with DeFi investments.

Verify whether the DeFi investment platform has undergone one or more code audits done by impartial auditors. A code audit normally entails carefully examining and studying the platform's underlying code to find any flaws or vulnerabilities that might impair the platform's functionality.

Be wary of DeFi investment pools with short join windows and quick smart contract rollouts, especially if they don't perform the advised code audit.

Be mindful of the potential risks crowdsourced solutions pose for finding and patching vulnerabilities. Open source code repositories give anyone, even those with malicious intent, unauthorized access.

This year, no DeFi-taken monies have been reimbursed, indicating that attackers are less interested in protecting their stolen assets than they were in 2021 when almost 25% of all cryptocurrency stolen via DeFi platforms was eventually recovered and given to the victims.

The FBI established a link between the Lazarus and BlueNorOff (also known as APT38) North Korean threat organizations and the April attack of Axie Infinity's Ronin network bridge, now the largest crypto hack ever.

The $611 million breach of the decentralized merge protocols and network Poly System in August 2021 was the most significant cryptocurrency theft to date.




Read more »
VPN
Bitcoin Cloudfare Data Breach Supply Chain Attack Twilio VPN

Over 130 Organizations Targeted in Okta Phishing Campaign

In a single phishing attempt, the hackers behind a number of recent attacks, such as those targeting Twilio, Cloudfare, MailChimp, and Klaviyo, infiltrated over 130 firms.

Through this phishing attack, 9,931 login credentials were stolen using a phishing kit with the codename "0ktapus," which the hackers then used to log into business networks and systems using VPNs and other remote access tools.

Because the primary intent of the assaults was to "get Okta identity credentials and two-factor authentication (2FA) codes from users of the targeted organizations," the conduct has been denounced by Group-IB.

The Singapore-based corporation said that the opponent sought out employees of businesses that use Okta, a provider of identity services, and praised the attacks for being well-planned and carried out. With the help of the identity-as-a-service (IDaaS) platform Okta, employees may access all of their company's software with just one login. 

The phrases "OKTA," "HELP," "VPN," and "SSO" were used in 169 different phishing domains that supported the 0ktapus campaign.  

In addition, customers who used these services, such as Signal, and DigitalOcean, became the target of supply-chain attacks as a result of these breaches.

The threat actors targeted businesses in a variety of areas, including bitcoin, technology, banking, and recruiting, based on the phishing domains built as part of this effort.

These login credentials were then utilized by the hackers to log into internal customer support systems, corporate networks, and VPNs in order to steal consumer data. As earlier witnessed with DigitalOcean and Signal, subsequent supply-chain hacks were carried out using this customer data.

The hacked information was disseminated over a Telegram channel via the phishing kit employed in this effort. One of the channel administrators who went by the handle "X" was connected by the experts to a Twitter and GitHub account, which suggests the person may be based in North Carolina, US.

Threat actors frequently targeted data belonging to organizations in the bitcoin industry, according to revelations from previous victims.

According to Group-IB, the hackers were able to steal 5,441 records with MFA codes, 3,129 data with emails, and 9,931 records with user credentials from 136 businesses, with the mass of the targeted businesses being based in the United States.



Read more »
Vulnerabilities and Exploits
Bitcoin cryptocurrency General Bytes Vulnerabilities and Exploits

Hackers Exploit Zero-Day Bug, Steal Crypto from Bitcoin ATMs

 


General Bytes and the Vulnerability

Hackers have abused a zero-day vulnerability in General Bytes Bitcoin ATM servers to get cryptocurrency from customers. When customers would deposit or buy cryptocurrency via the ATM, the funds would be stolen by hackers. 

General Bytes manufactures the Bitcoin ATMs that, according to the product, let people buy or sell more than 40 different cryptocurrencies. 

Actors Exploit CAS Zero-day

Crypto Application Server (CAS) controls the Bitcoin ATMs, looks over the ATM's operations, and the cryptocurrency it supports, and completes the sales and purchases of cryptocurrency on exchange forums. 

The attacks were carried out using a zero-day vulnerability in the company's Crypto Application Server (CAS). The hacker created an admin user remotely via CAS administrative interface through a URL call on the tab, using it for default installation on the server and therefore creating the first administration user. The vulnerability exists in the CAS software since version 20201208. 

General Bytes believes that the threat actors searched the internet for exposed servers that run on TCP ports 443 or 7777, this includes servers hosted at Digital Ocean and General Bytes' own cloud service.

Hackers exploit bugs to transfer money

The hackers then used the bug to put a default admin user named 'GB' in the CAS and changed the 'buy' and 'sell' crypto settings and 'invalid payment addresses' to use a cryptocurrency wallet within the attacker's control. 

After the hackers have modified these settings, any cryptocurrency sent to CAS was forwarded to the attackers instead. Two-way ATMs' began sending money into hackers' wallets when the customers deposited coins in the ATM. 

What should the users do?

General Bytes has warned its customers not to use their Bitcoin ATMs until the company has implemented two server patch releases 20220531.38 and 20220725.22, on their servers. General Bytes also gave a steps checklist for the devices before they are put back to use. 

We should note that the hackers wouldn't have been able to launch these attacks if the servers had a firewall, this would allow connections from only trusted servers. Hence, we should always configure firewalls to only give access to trusted IP addresses for the Crypto Application Server, for instance, the customer's offices or the ATM's location.

According to General Bytes, the following things didn't happen-

1. The attacker didn't gain access to the host operating system.
2. The attacker didn't gain access to the host file system.
3. The attacker didn't gain access to the database.
4. The attacker didn't gain access to any passwords, password hashes, salts, private keys, or API keys.

Currently, 18 General Bytes CAS are still vulnerable to the internet, most of these are located in Canada. We aren't aware of how many servers were compromised using this vulnerability and how much cryptocurrency was stolen. As of now, no further updates have come from General Bytes', CySecurity will update its readers in case.

Read more »
Ransom
Bitcoin cryptocurrency Cyber Crime Dutch University Ransom

Dutch University Receives Bitcoin Ransom Paid in 2019

 

The southern Maastricht University in Netherland that fell victim to a major ransomware assault has partly received back its stolen money, a local news organization reported on Saturday. 

The Dutch University suffered a large cyberattack in 2019 that locked them, and their students, out of valuable data until they agreed to pay a €200,000 ($208,000) ransom in Bitcoin which hackers demanded to decrypt the data.

"The criminals had encrypted hundreds of Windows servers and backup systems, preventing 25,000 students and employees from accessing scientific data, library and mail," the daily De Volkskrant told. 

"After a week the university decide to accede to the criminal gang's demand," the paper said. This was partly because personal data was in danger of being lost and students were unable to take an exam or work on their theses.” 

As part of an investigation into the cyberattack, local police traced part of the ransom paid to an account belonging to a money launderer in Ukraine. In 2020, the authorities seized the perpetrator's account, which contained a number of different cryptocurrencies including part of the ransom money paid by Maastricht University. 

Earlier this week, the authorities were able to return the ransom back to the university. But the value of the Bitcoin held in the Ukrainian account has increased from its then-value of €40,000 to €500,000.

"When, now after more than two years, it was finally possible to get that money to the Netherlands, the value had increased from 40,000 euros to half-a-million euros," the paper further read. Maastricht University will now get the 500,000 euros ($521,000) back. 

"This money will not go to a general fund, but into a fund to help financially strapped students," Maastricht University ICT director Michiel Borgers stated. 

The administrators of Maastricht University should count themselves lucky as they were able to retrieve their stolen money. Last year, the University of California paid $1.14 million to NetWalker attackers after they encrypted data within its School of Medicine’s servers, and the University of Utah paid hackers $457,000 to prevent them from releasing data stolen during an attack on its network. 

In 2021, ransomware attackers targeted 58 U.S. education organizations and school districts, including 830 individual schools, according to the report published by Emsisoft threat analyst Brett Callow. Emsisoft estimates that in 2020, 84 incidents disrupted learning at 1,681 individual schools, colleges, and universities.
Read more »
REvil
Bitcoin Canada Crypto heist Cyber Security Double extortion FBI NetWalker RaaS REvil

Netwalker: Ex Canadian Government Employee Pleads Guilty to Cybercrimes 

 

An ex-government of Canada official pleaded guilty in a US court to crimes related to data theft stemming from his involvement with the NetWalker ransomware group. 

Sebastien Vachon-Desjardins admitted on Tuesday that he had planned to commit bank fraud and phishing scams, intentionally damaged a protected computer, and also sent another demand regarding that illegally damaged computer. 

 Plea agreement filled 

Vachon-Desjardins, 34, who had previously been sentenced to six years and eight months in prison after entering a guilty plea to five criminal offenses in Canada, was deported to the United States in March. 
Vachon-Desjardins is "one of the most prolific NetWalker Ransomware affiliates," as per his plea agreement, and was in charge of extorting millions of dollars from several businesses all over the world. Along with 21 laptops, smartphones, game consoles, and other technological devices, he will also forfeit $21.5 million. 

He has pleaded guilty to conspiracy to commit computer fraud, conspiracy to commit wire fraud, intentionally harming a protected computer, and conveying a demand related to intentionally damaging a protected computer, according to a court filing submitted this week. The accusations carry a maximum punishment of 40 years in jail combined. The attorneys did not identify the targeted business, but they did indicate that it is based in Tampa and was assaulted on May 1, 2020. 

 NetWalker gang's collapse

In 2019, a ransomware-as-a-service operation called NetWalker first surfaced. It is thought that the malware's creators are based in Russia. Its standard procedure – a profitable strategy also known as double extortion, includes acquiring sensitive personal data, encrypting it, and then holding it hostage in exchange for cryptocurrencies, or risk having the material exposed online.

According to reports, the NetWalker gang intentionally targeted the healthcare industry during the COVID-19 pandemic to take advantage of the global disaster. To work for other RaaS groups like Sodinokibi (REvil), Suncrypt, and Ragnarlocker, Vachon-Desjardins is suspected of being connected to at least 91 attacks since April 2020 in his capacity as one of the 100 affiliates for the NetWalker gang. 

The Feds dismantled the crime gangs' servers and the dark website is used to contact ransomware victims as part of the takedown of the NetWalker gang. Then they took down Vachons-Desjardins, who, according to the FBI, made $27 million for the NetWalker gang. 

His role in cybercrime is said to have included gathering information on victims, managing the servers hosting tools for reconnaissance, privilege escalation, data theft, as well as running accounts that posted the stolen data on the data leak site and collecting payments following a successful attack. 

However, some victims did pay fees, and the plea deal connected Vachons-Desjardins to the successful extortion of roughly 1,864 Bitcoin in ransom payments, or about $21.5 million, from multiple businesses around the world.
Read more »
Wallet
Bitcoin Clipboard cryptocurrency Hackers malware Wallet

This New Malware Redirects Cryptocurrency Payments to Wallets Controlled by the Attacker

 

A clipper malware is a type of software that, once installed on a computer, continuously scans the contents of the user's clipboard for cryptocurrency wallets. If the user copies and pastes the wallet someplace, it gets substituted by the cybercriminal's wallet. 

As a result, if an unknowing user uses any interface to transfer a cryptocurrency payment to a wallet, which is often done by copying and pasting a valid destination wallet, the legitimate wallet is substituted with the fake one. Clipper malware is not a new issue, but it is unknown to the majority of individuals and businesses. 

The first clipper malware surfaced on Windows operating systems in 2017. In 2019, the same malware was also discovered on the Google Play Store. Clipper attacks are effective due to the duration of cryptocurrency wallets. People who transfer cryptocurrency from one wallet to another seldom double-check that the copy/paste result is the one given by a genuine receiver. Cyble researchers examined a new Clipper malware termed Keona Clipper by its developer. 

The malware is provided as a service for $49 per month. Keona Clipper was written in the.NET programming language and is safeguarded by Confuser 1.x. This tool protects.NET applications by changing symbols, obfuscating control flow, encrypting constants and resources, employing anti-debugging, memory dumping, tampering, and disabling decompilers, making reverse engineering more difficult. 

Since May 2022, Cyble researchers have identified over 90 distinct Keona samples, demonstrating widespread deployment. The discrepancy in those Keona samples might be due to minor changes in the code, or it could be the result of several usages of the Confuser protector, which generates a new binary each time a sample is provided to prevent detection by security solutions relying only on file signature. 

Malware capabilities of Keona Clipper

Once launched, the malware uses the Telegram API to connect with an attacker-controlled Telegram bot. The malware's initial contact with the bot includes a message written in Russian that translates as "clipper has started on the computer" and the username of the user whose account is utilised by the malware. 

The malware also ensures that it is always performed, even if the system is restarted. The malware copies itself to numerous areas, including the Administrative Tools folder and the Startup folder, to guarantee persistence. Autostart entries are also placed in the Windows registry to guarantee that the malware runs every time the computer restarts. Keona Clipper then discreetly analyses clipboard activity and checks for bitcoin wallets using regular expressions. 

BTC, ETH, LTC, XMR, XLM, XRP, NEC, BCH, ZCASH, BNB, DASH, DOGE, USDT TRC20, and ADA coins are among the cryptocurrencies that Keona Clipper can steal. If a wallet is discovered, it is instantly replaced in the clipboard with a wallet address supplied by the threat actor. 

How can one defend oneself against this danger?

Every bitcoin payment should be thoroughly scrutinised. By comparing the output of their copy/paste manipulation to the wallet given by the seller, users should visually authenticate the wallet utilised as the transaction's destination. Private keys and wallet seeds should never be kept insecurely on any device. If feasible, keep these encrypted on a different storage device or in a physical hardware wallet. 

To identify the danger, security solutions should be implemented. We don't know the first vector of propagation for Keona, but we think it was emailed, hence email-based protection must be deployed. Email fraud and phishing should also be made more visible to users. 

Finally, the operating system and any software that runs on it should be maintained up to date and patched at all times. If the malware is dumped and executed on the system via a popular vulnerability, a patched system will almost certainly halt the danger.
Read more »
WinRAR
Bitcoin C&C Crypto-Mining DLL malware P2P Botnets Symantec Trojan Attacks WinRAR

Clipminer Botnet Made 1.7 Million Dollars From Crypto Mining

 

Threat researchers have found a large-scale operation of Clipminer, a new cryptocurrency mining virus that netted its users at least $1.7 million in transaction hijacking.

Clipminer is built on the KryptoCibule malware, according to researchers at Symantec, a Broadcom company. Both trojans are designed to steal bitcoin wallets, hijack transactions, and mine cryptocurrency on affected computers. 

Clipminer is based on the KryptoCibule malware, according to researchers at Symantec, a Broadcom company. Both trojans are designed to steal bitcoin wallets, hijack transactions, and harvest cryptocurrency on affected computers. Researchers were taken aback by the new malware because it had fast grown in size by the time it was discovered. According to the Symantec team, these operations involved 4375 bitcoin wallet addresses that received stolen monies from victims.

Downloads or pirated software, are used to spread malware; malicious clipminer botnet files are distributed over torrent sites and other pirating methods. This bitcoin miner can be installed on the machine as a WinRAR archive, which will immediately start the extraction process and launch the control panel file, leading to the download of the dynamic link library. 

The infected DLL creates registry values and installs malware in several files in the Windows directory. Those files are named after ransoms so that the profile may be hosted and the main miner's payload can be downloaded and installed afterward. The system receives identification, which is sent on to the C&C server, which then sends out a request for the payload. The malware is delivered as a 10MB file in the Program Files directory. Once the trojan has been successfully executed, scheduled actions are set up to ensure the malware's persistence. To avoid re-infecting the same host, registry modification is also performed.

According to Symantec, the first Clipminer samples began to circulate in January 2021, with malicious activity picking up in February. Ever since the malware has spread over P2P networks, torrent indexers, YouTube videos, and through game and pirated software cracks. To avoid becoming infected with Clipminer or other malware, avoid downloading software from unknown sources. Verify the entered cryptocurrency wallet address before initiating the transaction to protect yourself from a clipboard hijacker.
Read more »
Technology
Bitcoin cryptocurrency Digital Asset digital currency FBI North Korean Hackers Technology

FBI: North Korean Hackers Stole $600M+ Worth Cryptocurrency

 

The FBI accused North Korean government associated hackers of stealing more than $600 million in bitcoin from a video game company last month, the latest in a sequence of sophisticated cyber thefts linked to Pyongyang. 

The FBI said in a statement, "Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29th." "DPRK" is an abbreviation for North Korea's official name, the Democratic People's Republic of Korea, and Ethereum is a technology platform linked with a type of cryptocurrency. 

The FBI was referring to the recent hack of Axie Infinity's computer network, which allows gamers to win cryptocurrency. Undiscovered hackers stole the equivalent of about $600 million — estimated at the time of the hack's detection — on March 23 from a "bridge," or network that allows users to transmit cryptocurrency from one blockchain to another, according to Sky Mavis, the business that developed Axie Infinity. 

The US Treasury Department sanctioned Lazarus Group, a large group of hackers suspected of working for the North Korean government, on Thursday. The precise "wallet," or bitcoin address, that was utilised to cash out on the Axie Infinity hack was sanctioned by the Treasury Department.

According to a United Nations panel and outside cybersecurity experts, cyberattacks have been a major source of revenue for the North Korean state for years as its leader, Kim Jong Un, pursued nuclear weapons. North Korea is reported to have fired its first intercontinental ballistic missile in more than four years last month. According to Chainalysis, a company that records digital currency transactions, the Lazarus Group has stolen an estimated $1.75 billion in cryptocurrencies in recent years. 

Ari Redbord, head of legal affairs at TRM Labs, a firm that investigates financial crime said,"A hack of a cryptocurrency business, unlike a retailer, for example, is essentially bank robbery at the speed of the internet and funds North Korea's destabilizing activity and weapons proliferation. As long as they are successful and profitable, they will not stop." 

While much of the focus of cybersecurity analysts has been on Russian hacking in the wake of the Ukraine conflict, suspected North Korean hackers have been far from silent. Last month, Google researchers revealed two separate suspected North Korean cyber attempts aimed at US media and IT businesses, as well as the bitcoin and financial technology industries. Users who are targeted by state-sponsored hackers are notified by Google. 

If a Google user has "any link to being active in Bitcoin or cryptocurrencies" and receives a warning from Google about state-backed hacking, it nearly invariably turns out to be North Korean activity, according to Shane Huntley, who leads Google's Threat Analysis Group.

Further, Huntley told CNN, "It seems to be an ongoing strategy for them to supplement and make money through this activity." 
Read more »
Ransomware Attacks.
Bitcoin Crypto Currency Crypto Currency law Cyber Security Cybersecurity EU IP addresses Ransomware Attacks.

Analysis of Cryptocurrency Fundraising

 

A cryptocurrency is a form of digital currency meant to make internet transactions extremely safe. Investors and authorities are paying attention to the unexpected increase in the value of cryptocurrencies. The digital era has surely aided in the advancement of our understanding and use of money. We are also on the verge of a new financial revolution, which is linked to the fourth industrial revolution. There are currently 9,271 distinct cryptocurrencies available, with Bitcoin, Ethereum, Tether, BNB, and USD being the most renowned ones.  

Cryptocurrencies, despite being older than the iPad, have just entered the public sphere, with their impact being predominantly felt in the last three or four years. The aspect of digital currencies has spread to numerous banks, including JP Morgan and Wells Fargo, which are developing their own cryptos. Blockchain, AI, IoT, and a slew of other technologies are making inroads into our daily lives as more traditional concepts and technologies are scrambling to stay up or risk becoming obsolete. 

Bitcoin, one of the most popular cryptocurrencies, was launched in 2009 and employs peer-to-peer technology to enable rapid transactions without the involvement of institutional bodies such as banks or governments. A password or a private key is required to access the received cryptocurrency in the wallet. Furthermore, the transaction is safeguarded by blockchain technology when it is sent from one wallet to another.

Physical currency serves as a universal measure of worth as well as a quick means of transmitting it. The switch to such a system would very certainly be tough, as cash may become incompatible in the blink of an eye if the crypto world advance at the current pace. Established banking institutions would almost certainly have to hustle to adapt. Governments across the world are now accepting blockchain and cryptocurrency. According to the Gartner report, 83 nations are currently experimenting with or deploying as such Central Bank Digital Currencies, or CBDCs, which account for 90 percent of global GDP. While many businesses initially offered to accept Bitcoin during its first boom, this list has progressively reduced, reinforcing doubt about the cryptocurrency's potential as a medium of trade. 

In India, cryptocurrency boomed relatively late when it already cost millions of rupees, as a result, Indians have few Satoshis (small units of a bitcoin) but this isn't the case in every situation. People are dealing in smaller units such as milli or micro bitcoins as the worth of cryptocurrency. 

Furthermore, the price of a cryptocurrency varies between exchanges, which is a clear breach of the legislation of one price.

While bitcoin performs admirably as a wealth vault, its volatility makes it riskier and exposes it to increased danger of loss. Several variables influence the price of a single bitcoin, like supply and demand, competition, and regulation. Investor perceptions of cryptocurrency are also influenced by recent news events.

The lack of other traits for crypto in India is typically associated with modern physical currencies; they cannot be deposited in a bank and must be held in digital wallets, which are costly and risky due to the possibility of hacking, staff corruption, public IP addresses, and ransomware. In many aspects, government supervision over central currency is essential for regulation, and cryptocurrencies would function with far less government oversight. Bitcoin's supply is set; there is an absolute limit of 21 million units.

In order to maintain steady price levels, the money supply must be able to rise in lockstep with macroeconomic activity, otherwise, the problem can only be solved by raising the velocity of money or by a substantial drop in prices. This might put the economy in jeopardy. 

For investors, bitcoin's artificial scarcity is a benefit: increased demand combined with inelastic supply leads to a greater price. The lack of a central regulator renders investor protection untenable and raises the likelihood of greater instability. People engage in these markets expecting the cryptocurrencies would grow in the future; this presumption fuels speculative behaviours, and a quick shift in the presumption may cause the market to crash, injuring many naive investors. 

The magnitude of economic harm is influenced by the connectivity between crypto-assets and the traditional banking industry. According to economists, direct exposure from cryptocurrencies to the financial system might be transmitted, and indirect repercussions could expand to other asset classes. Crypto assets, according to the RBI financial stability report (2021), offer long-term risks for capital control management, financial and macroeconomic stability, and monetary policy transmission.

China has taken the toughest stance on cryptocurrencies, going from allowing crypto mining to outright prohibiting it as of June 2021. Regulations are divided between the federal and state governments in the United States and India. Most EU draught Markets in Crypto-Assets Regulation (MiCA) legislation was announced by the European Commission in September 2020. The UK  is currently supervised by the Financial Conduct Authority (FCA). It's worth noting that the South American nation was the first to declare Bitcoin to be legal cash.

If we look at the evolution of crypto as a currency, it has virtually achieved its goal of decentralisation, and is now one of the main firms such as Tesla, Microsoft, and Meta are investing in it. On the other hand, the emerging cryptocurrency has the issue of being hackable. In the long run, if cryptocurrency continues to develop at its current rate, it may eventually replace fiat currency, resolving the issues of hacking and extreme volatility.
Read more »
Investigation
Bitcoin Crypto Cyber Security Germany Hydra Investigation

Germany Shuts Down World's Largest Illegal Marketplace on Darknet

 

The German authorities have confiscated the servers of Hydra Market, the most well-known Russian darknet network for drug sales and money laundering. The authorities were also able to seize 543 bitcoins worth a little more than $25 million from the earnings of Hydra. 

The money seized reflects the scale of the Hydra market, which had over 19,000 registered vendor accounts serving at least 17 million clients worldwide. Hydra Market had a turnover of $1.35 billion in 2020, according to the Central Office for Combating Cybercrime (ZIT) and Germany's Federal Criminal Police Office (BKA), making it the world's largest darknet market. 

Elliptic, a blockchain analytics firm, confirmed the authorities' confiscation of digital assets today, charting the action as 88 transactions totalling 543.3 bitcoin. Hydra also provided stolen databases, falsified documents, and hacking for hire services, in addition to the core focus of narcotics and money laundering. 

An investigation into a shady area 

The BKA, operating on behalf of the Attorney General's Office in Frankfurt am Main, confiscated the market's infrastructure following a coordinated international law enforcement action, according to Hydra's homepage. This move was made possible following a lengthy examination of the platform's previously unknown operators and administrators. 

 Hydra Market had a Bitcoin Bank Mixer, which disguised all bitcoin transactions done on the platform, making it difficult for law enforcement organisations to track money gained through illicit activity, according to the BKA announcement. 

According to a BKA spokesperson, no arrests have been made in this operation, and they are unable to give any other information on the evaluation of the confiscated infrastructure owing to ongoing investigations.
Read more »
Cyber Security
Bitcoin cryptocurrency Cryptocurrency Breach Cyber Security

Cryptocurrency Network Ronin Suffers Breach, Hackers Steal Millions

Ronin, a cryptocurrency network revealed a breach where threat actors swept $540 million worth of Ethereum and USDC stablecoin. The attack is one of the biggest in the history of cryptocurrency cyberattacks, particularly retrieved funds from a service called Ronin Bridge. Pulled-off attacks on "blockchain bridges" have become normal in the last two years, the Ronnie incident is a testimony to thinking hard about the problem. Blockchain bridges (network bridges) are apps that allow users to transfer digital assets from one blockchain to another. 

Cryptocurrencies can't usually interoperate, for instance, one can't do a transaction on a bitcoin platform via doge coins, hence, these "bridges" have become an important process, in the cryptocurrency world. Bridge services use 'cryptocurrency' to convert a bitcoin into another. For instance, if one goes to a bridge and uses a different cryptocurrency, like bitcoin (BTC), the bridge splits out wrapped Bitcoins (WBTC). In simple terms, it's similar to a gift card or a check that shows stored value in an open alternative format. 

Bridges require a vault of cryptocurrency coins to underwrite the total wrapped coins, and that trove is the primary target for threat actors. "Bridges will continue to grow because people will always want the opportunity to join new ecosystems. Over time, we'll professionalize, develop best practices, and there will be more people capable of building and analyzing bridge code. Bridges are new enough that there are very few experts," says James Prestwich. 

Besides the Ronin heist, hackers stole around $80 Million worth of cryptocurrency from the Qubit bridge in January, around $320 Million from the Wormhole bridge in February, and $4.2 Million a few days later from Meterio Bridge. Another thing that one should note is that Poly network had around $615 Million worth of cryptocurrency stolen in August last year, but the attackers returned the fund a few days after. "Ronin was created by the Vietnamese company Sky Mavis, which develops the popular NFT-based video game Axie Infinity. In the case of this bridge hack, it seems attackers used social engineering to trick their way into accessing the private encryption keys used to verify transactions on the network," reports the Wired.

Read more »
Pune Police
Bitcoin Crypto Scam Cyber Fraud CyberCrime Pune Police

Pune Police Recover Over Rs. 84 Crore Worth of Bitcoins From Two Cyber Experts

 

The Pune city Police have traced 237 bitcoins taken by two cyber specialists who were arrested for committing a multicrore cryptocurrency seizure fraud while assisting the cops in two cases in 2018.

Last month on March 12, the Pune City police’s cybercrime cell detained two specialists — Pankaj Ghode (38) and Ravindranath Patil (45) and an ex-IPS officer of Jammu and Kashmir cadre, following an exhaustive probe that began in April 2021. 

In 2018, Ghode and Patil aided a Pune police Special Investigations squad in uncovering two multimillion-dollar bitcoin ponzi schemes. The duo transferred the cryptocurrencies, recovered from the Gainbitcoin scam, and then manipulated the screenshots of those transactions and gave them to the police as proof. However, the technical investigation revealed that there were some bitcoins in the said wallet and Ghode did not give information regarding them to the investigating officer. 

Two FIRs were lodged at Dattawadi and Nigdi police stations against the duo for probing the fraud, under sections 406, 409, 420, 120 b, 109, 201 of the IPC and sections of the Maharashtra Protection of Interest of Depositors (MPID) Act. 

From the 17 persons arrested in the 2018 case, the Pune Police, had, with the assistance of Ghode and Patil, seized 241.46 Bitcoins, 452 Bitcoin cash units, and 94 Ethereum units. As of Thursday, 14:00 IST, Bitcoin was trading at 35,76,630, according to CoinMarketCap data, which means the recovered bitcoins are worth 84,88,88,259.00 as per recent exchange rates. 

“We have been able to trace as many 237 bitcoins to the wallets linked to Patil, equivalent to worth over Rs 84 crore. Prima facie, this chunk of cryptocurrency is from what was seized from the accused in the 2018 cases. The probe suggests that Patil was also involved in crypto trading. To date, we have seized Rs 6 crore worth of cryptocurrencies, such as Ethereum, Ripple, and four others. We are also probing a discrepancy of 900 bitcoins — equivalent to over Rs 320 crore today — in the reports submitted by Ghode at the time of the 2018 investigation,” an official who is part of the present investigation team stated.
Read more »
Subscribe to: Posts (Atom)