SecureList

AUGUST 30, 2023

While investigating an infection of a cryptocurrency company in Southeast Asia, we found Gopuram coexisting on target computers with AppleJeus , a backdoor attributed to the Lazarus. The threat actor specifically targeted cryptocurrency companies. We observed that they have a specific interest in cryptocurrency companies.

Malware 76

Malware Spyware Cryptocurrency Government 76

SecureList

DECEMBER 1, 2023

This included all contacts, sent and received messages with attached files, names of chats/channels, name and phone number of the account owner – the target’s entire correspondence. Upon startup, this backdoor makes a type A DNS request for the <hex-encoded 20-byte string> u.fdmpkg[.]org org domain.

Malware 96

Malware Ransomware Encryption Energy and Utilities 96

eSecurity Planet

JULY 28, 2021

Since blockchain’s arrival, cryptocurrency has framed the technology as permissionless, or a public blockchain. Going back to RSA 2018’s Cryptographers’ Panel , it was the ‘S’ in RSA, Adi Samir, who said blockchain could address threats presented by quantum computing. More robust security for Domain Name Systems (DNS).

Cybersecurity 135

Cybersecurity Cryptocurrency Technology Energy and Utilities 135

SecureList

MAY 27, 2022

In January, we reported a malicious campaign targeting companies that work with cryptocurrencies, smart contracts, decentralized finance and blockchain technology: the attackers are interested in fintech in general. The campaign has two goals: gathering information and stealing cryptocurrency. Roaming Mantis reaches Europe.

Phishing 108

Phishing Spyware Firmware Malware 108

SecureList

FEBRUARY 16, 2021

The DTLS (Datagram Transport Layer Security) protocol is used to establish secure connections over UDP, through which most DNS queries, as well as audio and video traffic, are sent. While the resource was down, cryptocurrency newbies were invited to download a copy of Bitcoin Core via a torrenting service.

DDOS 132

DDOS Cryptocurrency Marketing Internet 132

SecureList

NOVEMBER 18, 2022

Attempts to run malware for stealing money from online bank accounts were stopped on the computers of 99,989 unique users. The former threatened files accessible from the internet over SMB protocol and protected by a weak account password. Web Anti-Virus recognized 251,288,987 unique URLs as malicious. Local threats.

Mobile 88

Mobile Malware Ransomware IoT 88

SecureList

SEPTEMBER 26, 2022

RedLine’s main purpose is to steal credentials and information from browsers, in addition to stealing credit card details and cryptocurrency wallets from the compromised machine. After retrieving this information, the malware attempts to extract additional information like access tokens, account IDs, etc. ColdStealer.

Malware 113

Malware Cryptocurrency Passwords Software 113