TronWeekly

Crypto World News

You are here: Home / Archives for cyber attack

cyber attack

Hacking Group Robbed Nearly $200M From 5 Exchange Platforms

by

According to ClearSky ‘s report, on June 25, a single hacking group stole approximately $ 200 million from cryptocurrency exchanges. The malicious group used a spear-phishing strategy to gain access to cryptocurrency exchanges, which proved to be effective.

The hacking group is known as “CryptoCore,” which is believed to operate out of Eastern Europe. The report also notes that the group has been targeting attacks on crypto exchanges since 2018. CryptoCore focused mainly on the exchange platforms of the United States and China.

Over time , the group has managed to rip off some $200 million from various exchanges. However, ClearSky does not believe that they are technically advanced on a massive scale despite their success. The report notes that their main tactics are “swift, persistent and efficient.”

Hacking group strategy breakdown

Hackers have access to cryptocurrency wallets belonging to exchange firms. The hacking group begins with a broad review phase on the target exchange and its employees. The hacking group warms its way by deploying spear-phishing attacks; for example, they send emails to the firm’s executives through an email that looks like a top employee or a high-ranking partner company official.

Once they get into the system, the gang installs malware and infringes the executive’s password manager account; this is where all the private keys to all the cryptocurrency wallets are stored. The next step is to wait patiently for the multi-factor authenticator to be removed. If it is eliminated, the hacking group moves quickly and steals all the money from the wallets as per the report.

Spear-phishing attacks

In conclusion, spear-phishing attacks are a popular strategy used by cryptocurrency con men, and they are very problematic. Earlier this year, a major spear-phishing attack was deployed on YouTube users. As a result, multiple accounts with massive follow-ups and subscriptions; were compromised and hijacked when owners clicked on the link.

Beware of Fake Decryption Tool Exploiting Desperate Ransomware  Victims

by

Cyber criminals can be really annoying. This time round hackers have created malware in the shape of a decryption software that helps ransomware attack victims by encryption. The fake decryption tool will actually double encrypt your compromised files, not knowing you ‘re jumping from the frying pan to the actual fire.

A recent report by information security and technology news publication, Bleeping Computers, fake ransomware decryption software by STOP Djvu Ransomware, double-encrypts files that create a much bigger victim problem. According to the report, it lures already desperate victims with the guarantee of a free malware decryption tool, infecting them with another ransomware instead.

The malware dubbed “Zorab” was uncovered by the creator of ID Ransomware, Michael Gillespie. There are existing decryption tools that don’t charge huge amounts of money to decrypt files, exactly what the fake decryption tool is trying to do. The malware promises to decrypt files at no cost, but it eventually encrypts them multiple times.

 

Ransomware operatives such as REvil, Netwalker, DoppelPaymer and Maze are popular due to their high profile victims and attracting huge ransoms. Now there is another ransomware, STOP Djvu, which is already infecting more victims than the aforementioned popular operatives combined together on a daily basis.

How the fake decryption tool works

When a victim downloads the fake decryption tool and starts scanning his computer system by clicking the ‘start scan’ button, the ransomware draws out an executable file dubbed crab.exe; this is the zorab malware itself. Once this file is deployed, the fake decryption software double encrypts the entire files in the system with a .ZRB extension.

Fake Decryption Tool

Additionally, the ransomware creates ransom notes in every encrypted folder labeled ‘–DECRYPT–ZORAB.txt.ZRB.’ Inside the notes, there are details on how to reach the ransomware attackers to pay the ransom. The creation of a fake decryption tool was a clever idea to easily and quickly spread malware. Indeed, the Bleep Computer’s report described STOP Djvu Ransomware as “the most actively distributed ransomware over the past year.

Cryptocurrency Ransom Escalated by 200% in 2019

by

According to a report published by digital forensics firm, Crypsis Group, the already operational surging trend in demand of ransoms by criminals is growing. As per the data, cryptocurrency ransom Escalated sharply by 200 percent from 2018 to 2019.

The 2020 Incident Response and Data Breach Report published by Crypsis Group indicates that it’s not astonishing that cyber criminals have demanded outrageous cryptocurrency ransoms over the last three years. According to the firm, the average amount demanded by cyber criminals was $115,123.

Cryptocurrency ransom demands on the rise

Moreover, the digital forensics firm noted that cyber criminals are changing their strategies to focus on enterprises in their ransomware attacks. As per the report, the attackers cautiously select their victims, so as to target those with the capability to pay huge amounts. Tactics used by criminals are gradually advancing over time.

Indeed, these new strategies have also manifestly adjusted pretty well, to conquer defense strategies put in place by the unfortunate victims. Additionally, the report highlighted that last year saw the rise of ransomware alterations like Phobos, Sodinokibi (or “REvil”) and Ryuk claiming that their strategies are “highly effective.”

Ryuk ransomware was the most widespread variant back in 2019 according to the digital forensics company. The report notes that cyber criminals depend on a banking trojan called TrickBot, to deploy their scam and criminal activities to the victims. 

Common ransomware attacks

Back in Q4 2019, the most common type of ransomware was Sodinokibi on incidents count. In fact, Sodinokibi is a ransomware-as-a-Service but only facilitates a fixed amount of ransomware affiliates to spread the ransomware.

Furthermore, Ryuk was also prevalent in terrorizing large enterprises during Q4 of 2019. Additionally, it was the second most popular after Sodinokibi. The median amount of ransomware demand by Ryuk skyrocketed sharply which was responsible for the majority of the hike in the average ransom payment doubling in Q4 2019.

Coinsquare Attacker Discloses Evil Plan to Steal Bitcoin

by

The hacker behind the Coinsquare attack is now planning to use the data he stole during the attack to steal bitcoin and other digital currencies. The Coinsquare attacker plans to use the personal information he stole from the cryptocurrency exchange in Canada in a series of SIM swap attacks to steal digital currencies.

According to an anonymous attacker during an online chat with the media outlet, “The original intent was to sell it, but we figured we ‘d make more money by swapping SIM accounts.”

SIM swapping tactic to be used by Coinsquare attacker

SIM swapping refers to the action of cloning a victim’s SIM card to develop a copy that works exactly like the original. This strategy will facilitate the criminals in receiving any information that is sent to the original SIM card which includes confirmation codes, 2-factor authentication codes, and many other data.

For instance, access to this information could be used to access the victim’s cryptocurrency exchange accounts and steal BTC among other cryptocurrencies. In fact, SIM Swapping has been a common practice by criminals to steal valuable information from their victims. Last year, two criminals were charged in Massachusetts for using the SIM swapping strategy to steal crypto worth $550,000.

Hacker wanted to prove the exchange wrong

According to the Coinsquare attacker, the Canadian-based crypto exchange annoyed them by claiming to be the most secure cryptocurrency exchange in the country; and he took it as a challenge so as to embarrass them. The anonymous hacker said:

“I set out to embarrass the company for claiming they (sic) the most secure Canadian exchange; and obviously that is a lie.“

Furthermore, the individual revealed evidence that he did actually breach the exchange in the form of a list with email and physical addresses; as well as cellphone numbers of more than 5,000 Coinsquare clients. Notably, Coinsquare users can be relieved that the list did not contain any passwords.

Over $100 Million Stolen in Cryptocurrency as U.S Sanctions Charges Against Two Chinese Individuals

by

Illicit activities surrounding the digital assets medium found its way back in the headlines as a couple of Chinese individuals were sanctioned by the United States for money laundering accusations tied to a multi-million cryptocurrency fraud.

An official report from the U.S Department of the Treasury’s Office of Foreign Assets Control (OFAC) recently stated that Tian Yinyin and Li Jiadong played an influential part in moving more than $100 million in stolen crypto assets in a ‘cyber-intrusion’ against a digital asset exchange back in 2018. The hack was linked back to Lazarus Group, a government-backed North Korean cyber association that has played a major role at previous malicious attacks against the U.S and other national banks.

Over $250 million stolen in the 2018 Cyber-Hack

The aforementioned hack took place back in April 2018 and the estimated amount of cryptocurrency stolen was reported $250 million. The stolen funds accounted for nearly half of the Democratic People’s Republic of Korea (DPRK)’s virtual assets heist that particular year. The report stated,

“Tian and Li received from DPRK-controlled accounts approximately $91 million stolen in an April 2018 hack of a cryptocurrency exchange (referred to hereinafter as “the exchange”), as well as an additional $9.5 million from a hack of another exchange. Tian and Li transferred the currency among addresses they held, obfuscating the origin of the funds.”

Additionally, the report added,

“Tian ultimately moved the equivalent of more than $34 million of these illicit funds through a newly added bank account linked to his exchange account. Tian also transferred nearly $1.4 million dollars’ worth of Bitcoin into prepaid Apple iTunes gift cards, which at certain exchanges can be used for the purchase of additional Bitcoin.”

The Justice Department also revealed that the accused cyber-criminals were using doctored photographs and forged identifications in order to avoid security hassle and the stolen funds were utilized to carry out the expenses in other illegal hacking activities.

However, the hacked exchange in the discussion has not yet been confirmed as a result of multiple attacks by the North Korean Community in 2018.

Earlier that year, Coinrail, a crypto exchange based in South Korea was also reported to be a victim of a $40 million hack carried out by the Lazarus Group back in 2018.

After the announcement, Timothy Shea, the US attorney in Washington claimed,

“The hacking of virtual currency exchanges and related money laundering for the benefit of North Korean actors poses a grave threat to the security and integrity of the global financial system.”

Hackers have improved over time; Chainalysis

A recent report by Chainalysis indicated that, in order to improve the security of exchanges, hackers have simultaneously improved their game as well. In 2019, more than 11 assaults on exchanges took place, and perpetrators were able to steal more than $250 million. Although the amount is substantial, it drastically dropped from 2018’s enormous theft of $875.5 million, stolen collectively from six crypto exchanges.

The report also pointed fingers at the aforementioned Lazarus Group and believed that was responsible for the 2014 Sony Hack and 2017’s WannaCry ransomware attacks.

With digital assets and their exchanges slowly gaining these infiltrator’s attention, it was imperative to raise security standards and take precautionary measures to make sure such criminals are not using or taking advantage of large exchanges or institutions.

LATAM Exposes ‘The Dark Side’ of Cryptocurrencies

by

To have a clear picture of the world’s worst money laundry schemes, new cybercrime frontiers, and organized crime, perhaps Latin America (LATAM) is the best specimen for you. 

In the midst of a major economic downturn, Latin American countries are facing the worst money laundering schemes as a result of the increase in cryptocurrencies and unregulated P2P exchanges, according to a new report by threat intelligence firm Intsights and Ciphertrace.

According to the report, organized crime groups and drug cartels in LATAM countries use cryptocurrencies such as bitcoin; to cover up their tracks or fund their evil schemes.

The study has deepened into the crime scene in Latin American nations, exposing the challenges faced by law enforcement to curb the threat.

In particular, one way for criminals in LATAM nations to use digital currencies is through ‘ mixing services ‘ to confuse tainted digital currencies with others. Once criminals clean crypto through mixing, they trade in different exchanges and earn further income.

As part of money laundering schemes, criminal groups and cartels are taking advantage of inadequate KYC and AML standards by local exchanges and global P2P networks such as LocalBitcoin.

In fact, the report argues that a massive amount of illicit digital currencies around the globe ends up in LATAM cryptocurrency exchanges. Researchers at Intsights have found that exchanges in the Latin part of the world are usually denoted by indulgent regulations.

The report relates to the big money laundry case involving the payment processing firm Crypto Capital. The Panama-based crypto company was involved in a money laundry case worth up to $350 million.

Panama-Based Crypto Capital Money Laundry Saga

According to reports, Ivan Manuel Molina Lee, President of Crypto Capital, was detained by the law enforcement authorities on the grounds that he was directly involved in the scheme.

Crypto Capital has been able to mislead one of the biggest exchanges in the world, Bitfinex. Colombian drug cartels used cryptocurrencies to launder at least $350 million.

Additionally, criminals in Latin America take advantage of the leniency of P2P platforms; such as LocalBitcoin and Paxful to compound their interests. As per the report, this is the most preferred way for LATAM criminals.

The LocalBitcoin P2P platform has the highest trading volumes in Latin America. This is mainly due to the lack of or minimal regulations such as lack of AML and little KYC requirements. The report reads:

“Threat finance is evolving in Latin America as organized crime groups turn to cryptocurrency to launder large amounts of money and dive into the dark web to find hackers for hire…criminals are taking advantage of unregulated exchanges that do not require registration information and proof of identification for tracking purposes. These illegal exchanges are appealing to criminal groups that are looking to move large amounts of money through untracked channels.”

At Least 70% of the LATAM Population is Online

Furthermore, the report notes that 69 percent of the Latin American population is online, a significant percentage. Majority of Internet users come from Colombia and Brazil. The rapid digitization capped by political and economic precariousness; has resulted in increased hacking, fraud, money laundry, drug cartels and other crimes in the region.

In Conclusion,  this massive hornet’s nest is unlikely to be resolved soon anytime; due to the lack of anti-money laundry legislation in place and the poor state of law enforcement at LATAM.

However, the report suggests that firms or agencies willing to thwart the problem; should  “collect, monitor, and analyze cybercrime intelligence,” to learn and adopt the best security protocols.

 

 

Disclaimer note: This article is based on the writer’s opinions/research and does not necessarily represent the views and opinions of Tron Weekly. 

Cyber Attacks Continue As Mexico Becomes Victim, Again

by

Cyber-attacks have become very routine nowadays, with a lot of large-scale issues occurring on a weekly basis. Earlier, cyber attacks had only threatened local regions, but now they have hit world governments. Mexico has become the most recent country to announce a cyber-attack on its borders. Last Sunday, the ministry of economy of the region spotted an attack on some of its important servers

The Mexican ministry has stated that no sensitive information or data has been compromised given the severity of the attack. We have upgraded security protocols and procedures to ensure future safer firewalls. This was not the first time hackers had attacked Mexico since last November the country had been going through a similar event.

Officials close to the ministry have reassured everyone that no sensitive information pertaining to national security was stolen. The department has not yet revealed all the details about the attack and therefore it is not known if there existed a ransom note or not.

During the Pemex attack, hackers asked Bitcoin for $5 million to keep sensitive information from leaking to the organization’s servers. The hack also forced the company to shut down all systems and freeze payment systems. A ransom note found sent to Pemex showed a darknet website linked to DoppelPaymer, a ransomware-type.

The attacker had demanded 565 Bitcoin and threatened Pemex with a 48-hour deadline. The suspicious website also added that Pemex had missed the window for a special reduced ransom.

Last year, investigations had discovered that a lot of personal data may have been compromised in a data breach of a system hosted by the DISA. The DISA stands for the Defense Information Systems Agency and is responsible for providing direct telecommunications and IT support to the POTUS.