Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label cryptocurrency. Show all posts

Facebook, Nvidia Push SCOTUS to Limit Investor Lawsuits

 




The US Supreme Court is set to take two landmark cases over Facebook and Nvidia that may rewrite the way investors sue the tech sector after scandals. Two firms urge the Court to narrow legal options available for investment groups, saying claims made were unrealistic.


Facebook's Cambridge Analytica Case

The current scandal is that of Cambridge Analytica, which allowed third-party vendors access to hundreds of millions of user information without adequate check or follow-up. Facebook reportedly paid over $5 billion to the FTC and SEC this year alone due to purportedly lying to the users as well as to the investors about how it uses data. Still, investor class-action lawsuits over the scandal remain, and Facebook is appealing to the Supreme Court in an effort to block such claims.

Facebook argues that the previous data risks disclosed were hypothetical and therefore should not have been portrayed as if they already had happened. The company also argues that forcing it to disclose all past data incidents may lead to "over disclosure," making the reports filled with data not helpful but rather confusing for investors. Facebook thinks disclosure rules should be flexible; if the SEC wants some specific incidents disclosed, it should create new regulations for that purpose.


Nvidia and the Cryptocurrency Boom

The second is that of Nvidia, the world's biggest graphics chip maker, which, allegedly, had played down how much of its 2017-2018 revenue was from cryptocurrency mining. When the crypto market collapsed, Nvidia was forced to cut its earnings forecast, which was an unexpected move for investors. Subsequently, the SEC charged Nvidia with $5.5 million for not disclosing how much of its revenue was tied to the erratic crypto market.

Investors argue that the statements from Nvidia were misleading due to the actual risks but point out that Nvidia responds by saying that such misrepresentation was not done out of malice. However, they argue that demand cannot be predicted in such an ever-changing market and so would lead to unintentional mistakes. According to them, the existing laws for securities lawsuits already impose very high standards to deter the "fishing expedition," where investors try to sue over financial losses without proper evidence. Nvidia's lawyers opine that relaxing these standards would invite more cases; henceforth the economy is harmed as a whole.


Possible Impact of Supreme Court on Investor Litigation


The Supreme Court will hear arguments for Facebook on November 6th, and the case for Nvidia is scheduled for Nov 13th. Judgments could forever alter the framework under which tech companies can be held accountable to the investor class. A judgement in favour of Facebook and Nvidia would make it tougher for shareholders to file a claim and collect damages after a firm has suffered a crisis. It could give tech companies respite but, at the same time, narrow legal options open to shareholders.

These cases come at a time when the trend of business-friendly rulings from the Supreme Court is lowering the regulatory authority of agencies such as the SEC. Legal experts believe that this new conservative majority on the court may be more open than ever to appeals limiting "nuisance" lawsuits, arguing that these cases threaten business stability and economic growth.

Dealing with such cases, the Court would decide whether the federal rules must permit private investors to enforce standards of corporate accountability or if such responsibility of accountability should rest primarily with the regulatory bodies like the SEC.


The Evolution of Computer Crime: From Tinkering to Ransomware Threats

 



In the early days of computing, systems were relatively isolated, primarily reserved for academic and niche applications. Initial security incidents were more about experimentation gone wrong than intentional harm.

Today, the scenario is vastly different. Computers are everywhere—powering our homes, workplaces, and even critical infrastructure. With this increased reliance, new forms of cybercrime have emerged, driven by different motivations.

Computer crimes, which once revolved around simple scams and tech-savvy groups, have evolved. Modern attackers are more professional and devastating, often state-sponsored, like ransomware collectives.

A prime example of this evolution is ransomware. What began as simple criminal schemes has turned into a full-fledged industry, with criminals realizing that encrypting data and demanding payment is a highly lucrative enterprise.

Ransomware attacks follow a predictable pattern. First, the attacker deploys an encryptor on the victim’s system, locking them out. Then, they make their presence known through alarms and ransom demands. Finally, if the ransom is paid, some attackers provide a tool to decrypt the data, though others might threaten public exposure of sensitive data instead.

However, ransomware attackers face two key challenges. The first is infiltrating the target system, often achieved through phishing tactics or exploiting vulnerabilities. Attacks like WannaCry highlight how these methods can devastate unprotected systems.

The second challenge is receiving payment without revealing the attacker’s identity. Cryptocurrencies have helped solve this problem, allowing criminals to receive payments anonymously, making it harder for authorities to trace.

Preventing ransomware isn’t solely about avoiding the initial attack; it’s also about having a recovery strategy. Regular backups and proper employee training on cybersecurity protocols are crucial. Resilient companies use backup strategies to ensure they can restore systems quickly without paying ransoms.

However, backups must be thoroughly tested and isolated from the main system to prevent infection. Many companies fail to adequately test their backups, leading to a difficult recovery process in the event of an attack.

While ransomware isn’t a new concept in technical terms, its economic implications make it a growing threat. Cybercriminals can now act more ruthlessly and target industries that can afford to pay high ransoms. As these attacks become more common, companies must prepare to mitigate the damage and avoid paying ransoms altogether

Data Breach Exposes 93,000 Transak Users Due to Employee’s Device Misuse

 





Transak is an operation that enables users to buy cryptocurrencies using the Metamask, Binance, and Trust Wallet platforms. The company has just announced a data breach that exposed the names and identity documents of approximately 93,000 users. According to the company, the data breach happened through the misutilization of work equipment by the employee.


Facts of the Breach

The hack went through a company due to an abuse of work times by one of its employees through the use of his laptop for non-work purposes. In reality, it happened to be a malicious script run unknowingly by the employee. It gave cybercriminals access to one of the firm's third-party Know Your Customer (KYC) authentication services. It means that only 1.14% of users were affected, but even the leaked data contained sensitive personal documents like passports, ID cards, and selfies.

According to the Transak CEO, Sami Start, the leaked information was not about sensitive matters like social security numbers, bank statements, or emails. However, it's quite a serious concern in terms of privacy. The firm is terming this incident "mild to moderate" as no financial information was leaked.

 

Ransomware Group Claims Responsibility

The group behind the ransomware attack has now claimed responsibility for it and is trying to get a ransom out of Transak so that it does not publish any more of its data. It has already published parts of this stolen data online and says it has an even greater dataset, all up of over 300 GB in total, comprising sensitive personal documents, proof of address, financial statements, and so on. They have threatened to leak or sell the remaining data unless their threats are met.

However, despite the threat, Transak has not entered into negotiations with the attackers. Start averred that the company had reached out to affected customers and had also notified law enforcement agencies and relevant data regulators of the attack. He also believes that the ransomware group is inflating its report of data that they have obtained since only a subset of their KYC data was involved.


Cause and Impact

The vulnerability on the system of the KYC vendor is what hackers exploited after obtaining illegal access through the compromised employee's device, making the breach of data possible. This is an incident that brings out more sharply the risks involved when work equipment is misused or even failed to follow cybersecurity protocols. The affected employee was dismissed from the company afterward.

The CEO continued to say that the rest of the other systems were not affected within the system; the hackers had access only to this one KYC service. No other systems had been, nor would have been, compromised. Therefore, no information has leaked. Only a few rumours were spread that some other significant systems have been compromised.


Transak's Response

Transak is working with data regulators to manage the breach and is working on steps that will prevent this from happening again. The company assured its users also that there was no sensitive information stolen including one's password, credit card details, or a social security number. However, the exposure of their personal identification documents still poses risks for those affected users.

The aftermath of this incident has seen the company looking at various ways it can enhance its security measures to avoid such a breach from happening in the future. Even though the damage done is still under calculation, the response of Transak to the ransomware gang explicitly proves that latter has a stance on maintaining integrity despite the challenges posed to it by cyber-hoodlums.


The Transak data breach thus presents as a wake-up call to business by upholding proper cybersecurity in the management of work-related devices. With increased cyber-attacks on the crypto industry, businesses have to raise their mechanisms of protection for user data. Here, the hack demonstrated the possible risks that may be uncovered when security measures get badged by malicious actors.


Massive Global Fraud Campaign Exploits Fake Trading Apps on Apple and Google Platforms

 

A recent investigation by Group-IB revealed a large-scale fraud operation involving fake trading apps on the Apple App Store and Google Play Store, as well as phishing sites to deceive victims. The scheme is part of a wider investment scam known as "pig butchering," where fraudsters lure victims into investments by posing as romantic partners or financial advisors.

Victims are manipulated into losing funds, with scammers often requesting additional fees before disappearing with the money.

Group-IB, based in Singapore, noted that the campaign targets victims globally, with reports from regions like Asia-Pacific, Europe, the Middle East, and Africa. The fraudulent apps, created using the UniApp Framework, are labeled under "UniShadowTrade" and have been active since mid-2023, offering promises of quick financial gains.

One app, SBI-INT, even bypassed Apple’s App Store review process, giving it an illusion of legitimacy. The app disguised itself as a tool for algebraic formulas and 3D graphics calculations but was eventually removed from the marketplace.

The app used a technique that checked if the date was before July 22, 2024, and, if so, displayed a fake screen with mathematical formulas. After being taken down, scammers began distributing it via phishing websites for Android and iOS users.

For iOS, downloading the app involved installing a .plist file, requiring users to trust an Enterprise developer profile manually. Once done, the fraudulent app became operational, asking users for their phone number, password, and an invitation code.

After registration, victims went through a six-step process involving identity verification, providing personal details, and agreeing to terms for investments. Scammers then instructed them on which financial instruments to invest in, falsely promising high returns.

When victims tried to withdraw their funds, they were asked to pay additional fees to retrieve their investments, but the funds were instead stolen.

The malware also included a configuration with details about the URL hosting the login page, hidden within the app to avoid detection. One of these URLs was hosted by a legitimate service, TermsFeed, used for generating privacy policies and cookie consent banners.

Group-IB discovered another fake app on the Google Play Store called FINANS INSIGHTS, which had fewer than 5,000 downloads. A second app, FINANS TRADER6, was also linked to the same developer. Both apps targeted countries like Japan, South Korea, Cambodia, Thailand, and Cyprus.

Users are advised to be cautious with links, avoid messages from unknown sources, verify investment platforms, and review apps and their ratings before downloading.

PyPI Hosts Malicious Tools Targeting Crypto Wallets

 


During an investigation conducted recently, it was discovered that several malicious packages masquerading as services for recovering cryptocurrency wallets were found in the Python Package Index repository, revealing that they were spying on sensitive personal information and helping to steal cryptocurrency. A Checkmarx researcher described the attack as targeting Atomic, Trust Wallet, Metamask, Ronin, TronLink, Exodus, and many other prominent wallets within the crypto ecosystem in a report released on Tuesday. 

It was found that the packages presented themselves as tools that could extract mnemonic phrases and decrypt wallet data, suggesting that they could provide value to cryptocurrency users who are looking to recover or manage wallets" As long as cryptocurrencies remain a prime target for cybercriminals, they will continue to thrive in the ecosystem. 

The recent discovery of malicious packages located on the Python Package Index (PyPI) repository in the Python distribution has led to several tools that masquerade as tools that can help recover and manage crypto wallets. It is a fake tool that is used to steal sensitive information from users and facilitate the theft of valuable digital assets, among other things. 

According to Checkmarx researchers, there have been several malicious Python packages found on PyPI that attack users of leading cryptocurrency wallets like Atomic, Trust Wallet, MetaMask, Ronin, TronLink, and Exodus, as well as other popular apps. According to Checkmarx, the names of the packages in the Cryptocurrency ecosystem packages are deliberate efforts aimed at luring developers who are active in cryptocurrency ecosystems. 

The package descriptions on PyPI also came with links to installation instructions, examples on how to use them, and in one case, even an explanation of the "best practices" for virtual environments for installation. Again, this was meant to lend legitimacy to the libraries. Furthermore, the threat actor behind the campaign did more than simply deceive users about the popularity of the packages within the campaign, as they also displayed false download statistics, creating the impression that the packages were trustworthy and popular. 

In the identified PyPI packages, there was a dependency called cipherbcryptors that was required for the malicious code to be executed while in a few other cases, the Malware relied on ccl_leveldbases, which seemed to be an attempt to obfuscate the functionality by using another package. This is an important point to note in the case of the malicious functionality in the packages since the malicious functionality is only activated when certain functions are called, which is a departure from the typical pattern where such behaviour would be activated automatically by the installed package upon installation. 

An end-to-end process is then used to exfiltrate the data from the remote server into the hinterland. As Gelb explains, the attacker deployed an additional layer of security as he did not hard-code the address of their command-and-control server into any of the packages that were distributed. They had to rely on external sources to retrieve the information in a dynamic way rather than using internal resources. A technique commonly referred to as a dead drop resolver provides attackers with the flexibility to update the server information without having to update the packages themselves to take advantage of this type of attack. 

Furthermore, should the servers have to be taken down, it will make the process of switching between server infrastructures as simple as possible. This information has been collected to determine whether the attackers as part of their strategy to lure developers and end users will be successful. The author provides a great deal of information about the packages, including detailed descriptions, installation instructions, usage examples, and even best practices for running virtual machines at home. The hackers also manipulated download statistics to mislead the users into believing that the program was popular and trustworthy. 

It is noteworthy that the attackers used a technique known as a dead drop resolver to retrieve the addresses of their command and control servers efficiently. As a result of not hard-coding the server addresses within the packages, they will be able to update information about the servers without having to push new package versions, so security measures will be unable to detect and block the server updates. There was a recent discovery of fake crypto wallet recovery tools on PyPI. This underlines how cybercriminals are continuously evolving their tactics to target cryptocurrency and the crypto sector as a whole. 

The developers and users are equally responsible for safeguarding their digital assets, ensuring they are vigilant, practising due diligence when installing software packages, and utilizing security solutions such as Vulert to protect their assets. According to details revealed in August 2024, CryptoCore, an elaborate cryptocurrency scam that uses fake videos or hijacked accounts on social media platforms such as Facebook, Twitch, X, and YouTube as a method of tying users into selling their crypto assets under the guise of fast and easy profits, has been operating since August 2024. 

"This scam group and its giveaway campaigns will deceive users into sending their cryptocurrencies to the scammers' wallets by using deepfake technology, hijacked YouTube accounts, and professionally designed websites to deceive them into sending their cryptocurrencies to the scammers' wallets," Avast researcher Martin Chlumecký said. The most common way for scammers to convince potential victims that messages or events published online are official communications from trusted social media accounts or event pages is to persuade them to believe what is being posted online can be trusted. As a result, they can profit from the trust attached to the chosen brand, person, or event. 

Last week, a rogue Android app was impersonating the genuine WalletConnect protocol, which was used by the malware to steal around $70,00 in cryptocurrency by initiating fraudulent transactions from infected devices, as revealed by Check Point.

Russian Nationals Charged in Billion-Dollar Cryptocurrency Fraud

 




A tremendous blow has been dealt to global cybercrime after US authorities charged two Russian nationals with masterminding a giant cryptocurrency money laundering network. After being charged by the U.S., the two Russian nationals are alleged to have headmastered a giant cryptocurrency money laundering network. The couple laundered the billions through crypto exchange services, concealing ill-gotten gains from cyber frauds, ransomware, and dark web narcotics.

DOJ officials collaborated with worldwide law enforcement to obtain servers and USD 7 million in cryptocurrency from the network, effectively crippling the criminal organisation.

Vast Money Laundering Scheme Exposed

DOJ says the two Russians to be arraigned, Sergey Ivanov and Timur Shakhmametov, played a significant role in one of the largest money laundering operations. They traded billions of dollars for international cybercriminals through various cryptocurrency exchanges, including platforms like Cryptex and Joker's Stash. Their operation enabled criminals to avail themselves of the anonymity associated with cryptocurrencies, avoiding financial regulations, and even making their laundered funds more portable and unobservable.

Investigators said Ivanov operated Cryptex, a site that processed more than $1.15 billion in cryptocurrency transactions. Of that, $441 million was directly linked to crimes, including $297 million in fraud and $115 million in ransomware payments. Cryptex offered criminals a loophole because it didn't require users to have their IDs verified—a "know-your-customer" (KYC) compliance process would have made their transactions traceable.

The medium to support darknet criminals

Besides Cryptex, the operation made it possible to conduct many other illegal activities on the dark web like carding sites-Rescator and Joker's Stash. The said platforms, especially Joker's Stash, deal in stolen payment card information. Estimated proceeds from these operations ranged around $280 million to up to $1 billion. One of the defendants, Shakhmametov was said to manage Joker's Stash, and hence the extent of this criminal network increased.

Seizing Servers and Crypto Currency

Indeed, international cooperation figured quite largely into taking down this elaborate criminal enterprise. US authorities teamed with law enforcement agencies from other countries, such as Dutch authorities, to take down servers hosting such platforms as PM2BTC and Cryptex, located in several different countries, which have disrupted the operation. Moreover, law enforcement seized more than $7 million in cryptocurrency on those servers from the organisation.

According to the Justice Department, bitcoin transactions through Cryptex were pegged at 28% to the darknet markets that are U.S.-sanctioned, as well as other crime enterprises. This percentage emphasises the colossal level of participation that such exchanges provided in furthering cybercrimes at a worldwide level.

Global Crackdown on Cybercrime

The case reminds everyone that efforts at a global level are aimed at fighting the same cybercrime supported by cryptocurrencies. The DOJ has already communicated while working with other U.S. agencies, including the Department of State and the Treasury, that it will continue the crusade against those who use digital currencies for nefarious activities. In this case, the dismantling of this billion-dollar laundering network makes it a milestone victory for law enforcement and a warning to others in similar operations.

As cryptocurrency increases in usage, so does its misuse. Even though digital currencies offer immense legitimate advantages, they also provide criminals with a conduit to bypass traditional financial systems. This makes it pretty evident that the breaking down of Cryptex and Joker's Stash serves as a harsh reminder of how much importance needs to be given to strict security and regulatory measures so that such practices cannot be made using the system for nefarious purposes.

The recent charges suggest that U.S. and international law enforcement agencies are attacking cybercrime networks, especially those using cryptocurrency as a cover for under-the-radar activities. By taking down these systems, the authorities would find it more challenging for cybercrimes to cover up their illegal sources of income and further reduce the threat of rising cybercrime globally.

Hence, this high-profile case should awaken business entities and private individuals dealing in cryptocurrencies to take extreme care that they do not engage in any activity contrary to regulations set to monitor money laundering and other illegal activities.


Six Hackers Linked to Worldwide Cyber Attacks Arrested in Singapore


The Singaporean authorities have detained six people believed to be associated with a global cybercrime syndicate suspected of masterminding malicious cyber activities all over the world, latest reports said.

The arrest was a result of an extensive operation carried out by various law enforcement agencies in Singapore, further highlighting the growing complexity and reach of organised cybercrime.

The notion that hackers work in some sort of relative isolation is the furthest from the truth. The most substantial cyberattacks committed today are the work of organised crime or even state actors. The groups are very well organised and may be working in multiple countries to fulfil their objectives. To illustrate, North Korea-associated hacking entities have successfully withdrawn billions of dollars in ransomware attacks. These hackers don't work alone but instead use the assistance of other cyber-thieves who introduce them to sensitive information, corporate infrastructure, or digital tools which they use to push malware.

On September 9, 2024, Singapore's police conducted an operation of a large-scale raid comprising 160 officers from the Criminal Investigation Department, the Police Intelligence Department, the Special Operations Command, and the Internal Security Department. The raid was executed over several residential locations in Singapore and resulted in the arrest of six people- five Chinese nationals and one Singaporean. Members of these suspects have been associated with an international cybercrime group that is conducting its unlawful activities all over the world on the net.

Official sources claim that the suspects are connected to a gang engaged in malicious cyber activities from Singapore. During the operation, this resulted in the seizure of several devices, including hacking tools and personal data stolen from outside Singapore, as well as malware control software such as PlugX. Authorities further claim that they have seized about $850,000 worth of cryptocurrency from the suspects.

Even as the six men have been nabbed, investigations by the Singaporean police are still underway to find out their local network and connections with the worldwide cybercrime syndicate. Further investigations may throw more light on how all the cyber operations were executed from this location of Singapore.

The arrests once more underscore the cyber aspect, as criminal syndicates are using borderless operations to victimise private citizens, companies, and governments across the world. Singapore has acted quickly by arresting these hackers in the pursuit of controlling cybercrime and by underlining the importance of international cooperation, especially in fighting emerging threats.

This reminds one that cybercrime is a large and structured industry that goes beyond the hacker's operation. These criminal organisations are widely spread, and members of the outfit perform various other functions in an attack, including unauthorised access to computer systems and spewing of malware. The arrests are a blow to law enforcement agencies in Singapore, but further proof of the systemic problem of cybercrime on the global level.

International authorities have to come together, especially as cybercriminals get more clever and organised. The kind of cooperation between countries, of which the recent Singapore arrest is just a proof, helps dismantle the syndicates and bring before the law its perpetrators.



 

Cryptocurrency Scams Surge in 2023, FBI Reports Record $5.6 Billion in Losses

 

Despite cryptocurrency no longer dominating the headlines like it did during the 2021 to 2022 boom, cybercriminals are still leveraging it to generate billions of dollars in fraudulent income every year. According to the FBI, 2023 was the most lucrative year on record for cryptocurrency scammers, highlighting the growing scale of these crimes. 

In a report released by the FBI in 2023, it was revealed that cryptocurrency scams accounted for over $5.6 billion in losses, based on more than 69,000 complaints filed with the FBI’s Internet Crime Complaint Center (IC3). This represents a 45% increase from the previous year, demonstrating that despite market fluctuations, scams related to digital currencies are not slowing down. While the broader cryptocurrency market experienced turbulence in 2022, with the collapse of firms like Celsius, Terraform Labs, and the bankruptcy of FTX, scammers have continued to exploit the industry. 

The FBI’s report underscores that the losses from cryptocurrency scams now constitute more than half of the total losses from all online scams reported in 2022. This is a staggering statistic that demonstrates just how prevalent these schemes have become. Investment fraud remains the most common form of cryptocurrency scam, accounting for $3.96 billion of the total losses in 2023. This marks a sharp rise from the $2.57 billion lost to similar scams in 2022. The increasing sophistication of these scams has made it difficult for many people to discern legitimate investment opportunities from fraudulent ones. 

Interestingly, different types of scams tend to affect various age groups in different ways. For instance, those in their 30s and 40s were most frequently targeted by cryptocurrency investment frauds. However, individuals aged 60 and above suffered the most significant losses, with more than $1.6 billion reported by this age group alone. This data highlights the need for increased awareness and protective measures, especially for older individuals who may be more vulnerable to these scams. It’s crucial to note that the actual total of losses is likely much higher than the FBI’s report, as many victims do not report the crimes. 

FBI Director Christopher Wray urged people to report scams even if they did not suffer financial loss. According to Wray, doing so helps law enforcement stay ahead of criminals and their increasingly complex methods of defrauding people using emerging technologies. As cryptocurrency scams continue to grow in size and sophistication, it serves as a reminder that the need for strong cybersecurity measures and public awareness around digital currencies is more critical than ever. Reporting scams can not only help victims but also protect others from falling prey to similar fraudulent schemes.

Bitcoin ATM Emerges as Major Threat to Cryptocurrency

 


There is an ominous growth in Bitcoin ATMs across the United States, and some experts have claimed they are also one of the biggest cybercrime threats to the country. As with other ATMs, Bitcoin ATMs share a few characteristics with their cash counterparts: there are PINs to punch, and there are withdrawal fees as well. 

However, unlike cash ATMs, crypto ATMs have a high value, making them prime targets for hackers who are looking for ways to steal data. The problem is that whereas the location of a cash ATM at a gas station may not draw much attention, the location of a Bitcoin ATM gets more scrutiny from fraudulent individuals. The UK's National Crime Agency has reported in an article published by CNBC on September 8 that Bitcoin ATMs have proven to be one of the most popular ways for individuals to buy and sell cryptocurrencies, although they have additionally evolved into a prime target for hackers and scammers. 

There is no difference in the operation of these machines from traditional ATMs; however, thanks to the significant value of cryptocurrencies, they can be very attractive to cybercriminals, who will exploit both physical and digital vulnerabilities to their advantage. According to Timothy Bates, an assistant professor of cybersecurity at the University of Michigan, these machines are especially vulnerable to hacking due to the lack of security measures that are often part of the software used in these devices. 

According to Bates, Bitcoin ATMs can be infected by malware, which allows hackers to steal private keys and manipulate transactions through the use of malware. As well as this, an ATM can be compromised as a result of weaknesses in the security of the network, which may allow criminals to intercept communications between the ATM and its server, potentially allowing data theft to take place. As a result of malware installed by hackers on Bitcoin ATMs, they can be compromised, steal private keys, or manipulate transactions. 

It is especially concerning for ATMs that may not receive regular updates or security patches to prevent hackers from stealing funds or capturing private keys. A weakness in the network is also a weakness in the network security system. A compromised machine's network communications can be intercepted by attackers if the ATM's network communications are not adequately secured. Consequently, stolen data can be accessed or the server could be accessed by unauthorized persons, Bates explained. 

Bitcoin ATMs need to be taken seriously because of the threat posed by both hackers and scammers. Since 2020, according to a report released by the Federal Trade Commission this week, the number of scamming incidents has increased by 1,000%. In a curious twist, the risks associated with Bitcoin ATMs are directly proportional to their strengths, according to Joe Dobson, the principal analyst at Mandiant, which is owned by Google Cloud and a company that specializes in cybersecurity. 

There are three main characteristics of Bitcoin: decentralization, permissionlessness, and immutability. There is no way to reverse or reverse a transaction if funds are deposited to the wrong address, according to Dobson. Although many crypto bulls are attracted to Bitcoin because of its decentralization and lack of governance, it is a problem when used in ATMs. There are no regulations in the Bitcoin community that dictate who can run a Bitcoin ATM and who cannot, so independent organizations operate Bitcoin ATMs without any interference from the Bitcoin community," said Dobson. 

In addition to this, some old criminal tricks might be reversible in a traditional banking system, but not so in the Bitcoin world, which comes with its own set of unique challenges. It is possible for someone, for instance, to maliciously place their deposit slips into the bank stack, which can lead to folks being tricked into depositing money into their accounts unknowingly. According to Dobson, "there is the possibility that Bitcoin ATMs could also be subject to a similar attack." 

According to Dobson, "If an attacker compromises an ATM, they will be able to change the recipient wallet address (or "account number"), which in turn will steal the money of the user."  Bitcoin ATMs, however, continue to spread old tricks as well and they also introduce newer threats that are not encountered by cash ATMs. Several Bitcoin ATMs require that users provide personally identifiable information, such as their ID number or even their Social Security number to satisfy "Know Your Customer (KYC)" requirements that are necessary in the financial industry. 

Depending on the level of security that exists on a Bitcoin ATM, this information could be at risk. The Middletown Food Mart, located on the fringes of the town, in a hollowed-out section of the town near the town's main road, has a Bitcoin Depot ATM running alongside a regular cash machine, which blends in with the potato chips, bottled water, and beer on sale. 

Those who live in Middletown know that it is the hometown of Donald Trump's running mate, Ohio Senator J.D. Vance, who, similar to Trump, has refashioned himself as a crypto-advocate and has been speaking out against the adoption of Bitcoin. It is just a few blocks away from the Middletown Food Mart where Vance grew up where he works. Among the best ways to avoid these scams is to be cautious and sceptical about any requests from users who want to make payments through a Bitcoin ATM. It is rare that legitimate businesses if they exist, will request payment in Bitcoin via a machine for their services. 

During a transaction, users must verify the validity of the transaction, particularly checking the recipient's wallet for references to questionable entities," Frei said, adding that an additional precaution can be taken by using licensed ATMs from reliable operators. 

Users will be able to follow certain steps to make sure they are dealing with a Bitcoin ATM or party that is legitimate and owned by someone reputable. Adding to Frei's warning, he stressed the importance of being cautious and not sending bitcoins to unknown wallets. A platform like Chainabuse can help validate the legitimacy of the transaction by examining the risk score of the recipient's wallet, which can help verify their legitimacy. 

In the U.S., Bitcoin Depot operates over 8,000 ATMs, making it the country's largest operator of Bitcoin ATMs. Its chief executive, Brandon Mintz, assured CNBC that the company's software and hardware are designed to deter hackers, although he cautioned consumers not to fall victim to scams or be deceived by them. There seem to be just 10 operators worldwide who manage about 74% of ATMs in the world, as per Frei's analysis of data.

DMM Bitcoin Hack: 500 BTC Transfer Linked to $305 Million Theft Raises New Concerns

 

A cryptocurrency address linked to the $305 million DMM Bitcoin hack in May has reportedly transferred 500 Bitcoin, valued at approximately $30.4 million. On August 22, PeckShield Alert reported that the suspect address initially split the funds into two separate addresses, each receiving around 250 BTC. This movement of funds marks a significant development in the aftermath of the DMM Bitcoin hack, which remains one of the most substantial cryptocurrency thefts of 2024. The DMM Bitcoin hack, which occurred in May, resulted in the theft of 4,502.9 BTC, valued at approximately $305 million at the time. 

The current value of the stolen Bitcoin is just over $274 million. In response to the breach, DMM Bitcoin quickly raised $320 million to reimburse affected users, demonstrating the exchange’s commitment to mitigating the impact of the hack on its customers. Blockchain investigator ZachXBT previously attributed the attack to the Lazarus Group, a notorious hacking organization allegedly linked to the Democratic People’s Republic of Korea. The Lazarus Group has been implicated in several high-profile cyberattacks, and its involvement in the DMM Bitcoin hack highlights the growing sophistication of cybercriminals targeting the cryptocurrency industry. 

According to on-chain analysts, the methods used to launder the stolen funds and various off-chain indicators strongly suggest the Lazarus Group’s involvement in the heist. Following the hack, the attackers reportedly split the stolen Bitcoin into smaller batches of 500 BTC and transferred them to new wallets. PeckShield identified that the latest funds moved since the May 31 incident originated from one of these wallets. This strategy of splitting and moving funds is a common tactic among cybercriminals to obfuscate the trail of stolen assets and avoid detection. 

In July, ZachXBT alleged that the attackers transferred approximately $35 million worth of Bitcoin to the Cambodia-based exchange Huione Guarantee. The exchange has faced accusations of facilitating the laundering of funds from various crypto hacks, pig butchering scams, and other illicit activities. The involvement of exchanges like Huione underscores the challenges in tracking and recovering stolen cryptocurrency, as these platforms can serve as intermediaries for converting stolen assets into fiat currency or other cryptocurrencies. 

The DMM Bitcoin hack is a significant addition to the growing list of cryptocurrency thefts in 2024, which had already claimed over $473 million in losses before this incident. The hack is the second largest in Japan’s history, following the 58 billion yen loss suffered by Coincheck in 2018. In the aftermath of the DMM Bitcoin hack, the exchange halted all spot trading on its platform and warned that withdrawals in Japanese yen might take longer than usual, as they implemented measures to prevent further unauthorized outflows. This incident also highlights broader trends in the cryptocurrency industry. 

According to a Chainalysis report, while illegal activity on blockchain networks has decreased by almost 20% year-to-date, malware attacks and stolen funds have surged. Stolen funds inflows doubled to $1.58 billion compared to $857 million last year, and ransomware inflows climbed around 2%, reaching $459.8 million. The DMM Bitcoin hack serves as a stark reminder of the ongoing vulnerabilities in the cryptocurrency sector and the need for enhanced security measures to protect digital assets from increasingly sophisticated cyber threats.

Unicoin's Four-Day Cyberattack: Disruption, Recovery, and Ongoing Investigation

 



Unicoin, a leading cryptocurrency company, experienced a cyberattack beginning on August 9, 2024, which severely disrupted its operations for nearly four days. The breach occurred when a hacker gained unauthorised access to the company’s Google G-Suite account, affecting all employees using the "@unicoin.com" domain. As a result, employees were locked out of critical Google services like Gmail and Google Drive, causing major disruptions in internal communication and file sharing.

In a regulatory filing with the U.S. Securities and Exchange Commission (SEC), Unicoin detailed the extent of the attack, noting that the hacker not only altered account passwords but also restricted access to essential tools. The company managed to restore access to its systems by August 13, 2024. However, ongoing investigations have revealed additional issues stemming from the breach.

Several senior management email accounts were compromised, and further investigations uncovered anomalies in the personal information of employees and contractors. The company’s accounting department discovered several discrepancies, including an instance of identity forgery involving a contractor, which led to their immediate termination. Investigators are still determining whether these incidents are isolated or part of a larger cyber threat, potentially involving North Korean hackers.

Financial Impact and Investigation

Despite the severity of the breach, Unicoin has assured its stakeholders that there is no evidence of stolen funds or compromised cryptocurrency assets. While the situation is serious, the company stated that the attack has not immensely impacted its financial condition or operational performance. However, the full extent of the breach is still under review, and Unicoin has not ruled out the possibility of long-term financial consequences.

In its SEC filing, Unicoin emphasised that no immediate financial losses had been identified. The company has committed to continuing its assessment of the situation and will report any significant impact in future filings if necessary.

Cybersecurity Concerns in the Cryptocurrency Sector

Unicoin's adherence to regulatory compliance stands out in the cryptocurrency industry, where oversight is often limited. The company consistently files reports with the SEC, demonstrating its commitment to transparency. With more than $500 million in Unicoins sold and a diverse portfolio that includes real estate and equity investments, the recent cyberattack is a telling event of how even the well regulated firms are not immune to combating such vulnerabilities. 

As investigations continue, the broader cryptocurrency industry will be closely monitoring Unicoin's response to this breach and the steps it takes to better amp up its cybersecurity defenses.

Cryptojacking Attacks Soar 409% in India Amid a Global Shift in Cybersecurity Tactics

 


A rise in technology has also led to an increase in cybersecurity concerns as a result of the rise of technology. It is becoming more and more common for users across the world to fall victim to online scams day after day, and this is even getting the authorities in action, as they're now attempting to combat this trend by taking steps to introduce safeguards for users. 

According to the first half of 2024 global statistics, malware volume increased by a whopping 30 per cent on a global scale. As a result of this increase alone, the number of reports increased by 92 per cent in May. Throughout 2024, the number of malware attacks in the country increased by 11 per cent and ransomware attacks rose by 22 per cent, indicating that businesses are facing more cyber threats than ever before, according to a report by SonicWall. 

A SonicWall report published in February 2024 revealed that malware attacks increased by eleven per cent in volume from 12,13,528 in 2023 to 13,44,566 in 2024 as compared to the previous year. IoT (Internet of Things) attacks have increased by 59 per cent in the last year, with 16,80,787 attacks occurring annually in 2024 as opposed to 10,57,320 in 2023, the study found. 

There is no doubt that India is making substantial efforts to become one of the leading countries in the field of technology. While the use of technology has increased over the years, a recent trend has also been accompanied by significant cybersecurity risks. Attacks on Internet of Things (IoT) devices have increased by 59 per cent in 2024 as compared to 1,057,320 in 2023, which marks an increase of 11 per cent in malware attacks, a 22 per cent increase in ransomware attacks, and an 11 per cent increase in Internet of Things (IoT) attacks. 

According to the report, there was a marked increase in both ransomware attacks and crypto attacks; the latter grew by an astonishing 409 per cent. The SonicWall Vice President for APJ Sales, Debasish Mukherjee, noted that organizations are facing an increasingly hostile threat environment because attackers are continuing to innovate beyond traditional defences to become more successful. According to the "Mid-Year Cyber Threat Report" published by SonicWall, the rise of new cyber threats is becoming increasingly prevalent among businesses due to these new developments in cybersecurity. 

Cryptojacking attacks are increasing, and India has reported the highest number of attacks with a 409 per cent increase compared to a global decline of 60 per cent — a startling statistic. In a recent report published by SonicWall Capture Labs, SonicWall released the 2024 SonicWall Mid-Year Cyber Threat Report today. This report reveals that cyber threats are once again on the rise after an 11% increase in 2023, confirming the 11% rise in high-quality attacks since 2023.

A report published by the company details the changing threat landscape over the first five months of this year, showing the persistence, relentlessness, and ever-growing nature of cyber threats across the globe. A report that has been designed with SonicWall's partners in mind, has undergone several changes over the past few years, much like SonicWall itself has undergone several changes. As part of its evolution, the report has recently changed the way it measures vital cyber threat data to include time as a component. 

A key part of the report outlines the latest threats which are affecting our partners and the customers they serve, and for the first time, it highlights how attacks can have a direct impact on our partners, including threats to revenue. According to SonicWall intelligence, on average, companies are likely to be under critical attack - that is, attacks which are most likely to deplete business resources - for 1,104 of the 880 working hours they have in a given month. 

In the first five months of 2024, businesses were shielded from potential downtime of up to 46 days, a critical safeguard that protected 12.6% of total revenues from potentially devastating cyber intrusions. This significant finding was among the key insights from a recent report, underscoring the escalating threats faced by modern enterprises. 

Douglas McKee, Executive Director of Threat Research at SonicWall, emphasized the importance of robust cybersecurity measures, stating, "The data and examples found in the report provide real-life scenarios of how crafty and swift malicious actors operate, underscoring that traditional cybersecurity defences often prove to be the most reliable." One of the most pressing concerns highlighted in the report is the increasing sophistication of supply chain attacks. 

These attacks exploit the interconnectedness of modern enterprises, targeting vulnerabilities in third-party software and services to compromise broader networks. The first half of 2024 saw several sophisticated attacks, including a high-profile breach involving the JetBrains TeamCity authentication bypass. By the end of 2023, three out of the top five companies globally had already suffered supply chain breaches, affecting more than 50% of their customers. 

These breaches were primarily due to vulnerabilities such as Log4j Log4Shell and Heartbleed. The report also revealed that organizations, on average, took 55 days to patch even 50% of their critical vulnerabilities, further exposing them to risk. In response to these growing threats, Microsoft has made significant strides in addressing vulnerabilities. 

In 2023, the company patched more than 900 vulnerabilities, with Remote Code Execution (RCE) vulnerabilities accounting for 36% of them. Despite the high number of RCE vulnerabilities, they were exploited only 5% of the time. In contrast, Elevation of Privilege vulnerabilities, which were leveraged 52% of the time, posed a greater risk. By mid-2024, Microsoft had already patched 434 vulnerabilities, matching the record set in 2023. 

Notably, 40% of these vulnerabilities were classified as RCE, yet 86% of the exploited vulnerabilities were related to Security Feature Bypass or Elevation of Privilege issues. The report also sheds light on the growing threat posed by Remote Access Trojans (RATs). These malicious programs disguise themselves as legitimate applications to obtain necessary permissions and connect to command-and-control servers, enabling them to steal sensitive information and bypass multi-factor authentication (MFA). Industries will experience several sophisticated RAT attacks in 2024, with malware such as Anubis, AhMyth, and Cerberus evolving to bypass MFA, making them a significant cybersecurity threat. PowerShell, a versatile scripting language and command-line shell, has also become a favoured tool among malicious actors due to its user-friendly features. 

The report revealed that 90% of prevalent malware families, including AgentTesla, AsyncRAT, GuLoader, DBatLoader, and LokiBot, utilize PowerShell for malicious activities. Of these, 73% use PowerShell to download additional malware, evade detection, and carry out other harmful actions. This report serves as a stark reminder of the increasing sophistication and prevalence of cyber threats in 2024, underscoring the need for continued vigilance and robust cybersecurity measures to protect businesses and their customers.

WazirX Responds to Major Cyberattack with Trading Halt and Bounty Program

 

In the wake of a significant cyberattack, WazirX, one of India’s foremost cryptocurrency exchanges, has taken drastic measures to mitigate the damage. The exchange announced a halt in trading and introduced a bounty program aimed at recovering stolen assets. This attack has severely impacted their ability to maintain 1:1 collateral with assets, necessitating immediate action. 

In a series of posts on X, WazirX detailed their response to the breach. They have filed a police complaint and reported the incident to the Financial Intelligence Unit (FIU) and CERT-In. Co-founder Nischal Shetty emphasized the urgency of the situation, stating that the exchange is reaching out to over 500 other exchanges to block the identified addresses associated with the stolen funds. This broad collaboration is essential as the stolen assets move through various platforms. 

To further their recovery efforts, WazirX is launching a bounty program to incentivize individuals and entities to help freeze or recover the stolen assets. This initiative is part of a broader strategy to trace the stolen funds and enhance the security measures of the exchange. The team is also consulting with several expert groups specializing in cryptocurrency transaction tracking to provide continuous monitoring and support during the recovery process. The exchange expressed gratitude for the support from the broader Web3 ecosystem, underscoring the need for a collective effort to resolve the issue and maintain the integrity of the Web3 community. 

Shetty mentioned that the team is conducting a thorough analysis to understand the extent of the damage caused by the attack. This analysis is crucial for developing an effective recovery plan and ensuring that all possible measures are taken to protect customer funds. In addition to their internal efforts, WazirX is working closely with forensic experts and law enforcement agencies to identify and apprehend the perpetrators. This collaboration aims to ensure that those responsible are brought to justice and that as many stolen assets as possible are recovered. 

The cyberattack has resulted in a substantial loss of approximately $235 million, making it one of the largest hacks of a centralized exchange in recent history. Crypto investigator ZachXBT revealed that the main attacker’s wallet still holds over $104 million in funds, which have yet to be offloaded. 

This highlights the ongoing challenges and complexities of securing digital assets in the ever-evolving cryptocurrency landscape. WazirX’s proactive measures and the support from the broader community will be crucial in navigating this crisis and reinforcing the security frameworks essential for the future of cryptocurrency exchanges.

Ransomware Group Uses Harassment Tactics to Secure Payments


 

A newly identified ransomware group named Volcano Demon is using aggressive tactics to compel victims to pay ransoms. Halycon, an anti-ransomware firm, recently reported that this group has targeted several organisations in the past weeks with a new encryption tool called LukaLocker.

Attack Strategy

Volcano Demon’s attack method is both simple and effective. Initially, the hackers infiltrate the target’s network, mapping it out and stealing as many sensitive files as they can. Following this, they deploy LukaLocker to encrypt files and entire systems. The victims are then instructed to pay a ransom in cryptocurrency to receive the decryption key and prevent the stolen data from being leaked.

Technical Details of LukaLocker

LukaLocker works by adding a .nba extension to encrypted files and is capable of operating on both Windows and Linux systems. The encryptor is proficient at hiding its tracks by erasing logs before exploitation, making it difficult for cybersecurity experts to perform a full forensic analysis. Furthermore, LukaLocker can disable processes linked to most major antivirus and anti-malware solutions, making recovery efforts even more challenging.

Unlike typical ransomware groups that maintain dedicated data leak sites, Volcano Demon employs a more direct and intimidating approach. They contact the leadership of the victimised companies via phone calls from unidentified numbers to negotiate ransom payments. These calls are often threatening in nature, adding psychological pressure to the already stressful situation of a ransomware attack.

Impact on Businesses

The harassment tactic used by Volcano Demon increases the urgency and stress for affected businesses. The inability to conduct thorough forensic investigations due to LukaLocker’s log-clearing capabilities leaves victims vulnerable and with limited recovery options.

Businesses must enhance their cybersecurity measures to reduce the risk of such attacks. Implementing comprehensive logging and monitoring solutions, maintaining regular backups, and educating employees about common infiltration methods like phishing are critical steps. Additionally, organisations should ensure their antivirus and anti-malware solutions are robust and regularly updated to counteract disabling mechanisms like those employed by LukaLocker.

Volcano Demon’s innovative approach to ransomware, characterised by harassing phone calls and sophisticated encryption methods, underscores the developing nature of cyber threats. As cybercriminals develop new strategies to exploit vulnerabilities, it is essential for businesses to remain vigilant and proactive in their cybersecurity efforts to protect sensitive data and ensure operational continuity.




Zero-Knowledge Proofs: How They Improve Blockchain Privacy?



Zero-knowledge proofs (ZKPs) are emerging as a vital component in blockchain technology, offering a way to maintain transactional privacy and integrity. These cryptographic methods enable verification without revealing the actual data, paving the way for more secure and private blockchain environments.

At its core, a zero-knowledge proof allows one party (the prover) to prove to another party (the verifier) that they know certain information without disclosing the information itself. This is particularly valuable in the blockchain realm, where transparency is key but privacy is also crucial. For example, smart contracts often contain sensitive financial or personal data that must be protected from unauthorised access.

How ZKPs Operate

A ZKP involves the prover performing actions that confirm they know the hidden data. If an unauthorised party attempts to guess these actions, the verifier's procedures will expose the falsity of their claim. ZKPs can be interactive, requiring repeated verifications, or non-interactive, where a single proof suffices for multiple verifiers.

The concept of ZKPs was introduced in a 1985 MIT paper by Shafi Goldwasser and Silvio Micali, which demonstrated the feasibility of proving statements about data without revealing the data itself. Key characteristics of ZKPs include:

  • Completeness: If the prover's statement is true, the verifier will be convinced.
  • Soundness: If the prover's statement is false, the verifier will detect the deception. 
  • Zero-Knowledge: The proof does not reveal any additional information beyond the validity of the statement.

Types of Zero-Knowledge Proofs

Zero-knowledge proofs come in various forms, each offering unique benefits in terms of proof times, verification times, and proof sizes:

  • PLONK: An acronym for "Permutations over Lagrange-bases for Oecumenical Non-interactive arguments of Knowledge," PLONK is known for its versatility. It supports various applications and allows a large number of participants, making it one of the most widely used and trusted ZKP setups.cyber 
  • ZK-SNARKs: Short for "Succinct Non-interactive Argument of Knowledge," ZK-SNARKs are popular due to their efficiency. These proofs are quick to generate and verify, requiring fewer computational resources. They use elliptic curves for cryptographic proofs, making them suitable for systems with limited processing power.

  • ZK-STARKs: "Scalable Transparent ARgument of Knowledge" proofs are designed for scalability and speed. They require minimal interaction between the prover and verifier, which speeds up the verification process. ZK-STARKs are also transparent, meaning they do not require a trusted setup, enhancing their security.
  • Bulletproofs: These are short, non-interactive zero-knowledge proofs that do not require a trusted setup, making them ideal for applications needing high privacy, such as confidential cryptocurrency transactions. Bulletproofs are efficient and compact, providing strong privacy guarantees without significant overhead.

Advantages for Blockchain Privacy

ZKPs are instrumental in preserving privacy on public blockchains, which are typically transparent by design. They enable the execution of smart contracts—self-executing programs that perform agreed-upon actions—without revealing sensitive data. This is particularly important for institutions like banks, which need to protect personal data while complying with regulatory requirements.

For instance, financial institutions can use ZKPs to interact with public blockchain networks, keeping their data private while benefiting from the broader user base. The London Stock Exchange is exploring ZKPs to enhance security and handle large volumes of financial data efficiently.

Practical Applications

Zero-knowledge proofs have a wide array of applications across various sectors, enhancing privacy and security:

1. Private Transactions: Cryptocurrencies like Zcash utilise ZKPs to keep transaction details confidential. By employing ZKPs, Zcash ensures that the sender, receiver, and transaction amount remain private, providing users with enhanced security and anonymity.

2. Decentralised Identity and Authentication: ZKPs can secure identity management systems, allowing users to verify their identity without revealing personal details. This is crucial for protecting sensitive information in digital interactions and can be applied in various fields, from online banking to voting systems.

3. Verifiable Computations: Decentralised oracle networks can leverage ZKPs to access and verify off-chain data without exposing it. For example, a smart contract can obtain weather data from an external source and prove its authenticity using ZKPs, ensuring the data's integrity without compromising privacy.

4. Supply Chain Management: ZKPs can enhance transparency and security in supply chains by verifying the authenticity and origin of products without disclosing sensitive business information. This can prevent fraud and ensure the integrity of goods as they move through the supply chain.

5. Healthcare: In the healthcare sector, ZKPs can protect patient data while allowing healthcare providers to verify medical records and credentials. This ensures that sensitive medical information is kept confidential while enabling secure data sharing between authorised parties.

Challenges and Future Prospects

Despite their promise, ZKPs face challenges, particularly regarding the hardware needed for efficient proof generation. Advanced GPUs are required for parallel processing to speed up the process. Technologies like PLONK are addressing these issues with improved algorithms, but further developments are needed to simplify and broaden ZKP adoption.

Businesses are increasingly integrating blockchain technologies, including ZKPs, to enhance security and efficiency. With ongoing investment in cryptocurrency infrastructure, ZKPs are expected to play a crucial role in creating a decentralized, privacy-focused internet.

Zero-knowledge proofs are revolutionising blockchain privacy, enabling secure and confidential transactions. While challenges remain, the rapid development and significant investment in this technology suggest a bright future for ZKPs, making them a cornerstone of modern blockchain applications.


New MacOS Malware Steals Browser Data and Cryptocurrency

 



While malware attacks on Windows and Android systems are more frequent, macOS is not immune to such dangers. Cybersecurity experts at Moonlock Lab have identified a new type of macOS malware that adeptly avoids detection and poses a serious threat to user data and cryptocurrency.


How the Malware Spreads

The infection starts when users visit websites that offer pirated software. On these sites, they might download a file called CleanMyMacCrack.dmg, thinking it’s a cracked version of the CleanMyMac utility. However, launching this DMG file triggers a Mach-O executable, which then downloads an AppleScript. This script is specifically designed to steal sensitive information from the infected Mac.


Malware Capabilities

Once the malware infiltrates a macOS system, it can carry out a range of malicious activities:

  • It captures and stores the Mac user's username.
  •  The malware sets up temporary directories to store stolen information temporarily.
  •  It retrieves browsing history, cookies, saved passwords, and other data from different web browsers.
  •  The malware identifies and accesses directories containing cryptocurrency wallets.
  •  It copies data from the macOS keychain, Apple Notes, and Safari cookies.
  •  It gathers general user information, system specifications, and metadata.
  •  All the collected data is eventually exfiltrated to the attackers.


Link to a Known Hacker

Moonlock Lab has traced this macOS malware back to a notorious Russian-speaking hacker known as Rodrigo4. This individual has been seen on the XSS underground forum, where he is actively seeking collaborators to help spread his malware through search engine optimization (SEO) manipulation and online advertisements.

Rodrigo4's method involves manipulating search engine results and placing ads to lure unsuspecting users into downloading the malicious software. By making the malware appear as a popular utility, he increases the chances of users downloading and installing it, unknowingly compromising their systems.


How to Protect Yourself

To prevent this malware from infecting your Mac, Moonlock Lab recommends several precautions:

1. Only download software from reputable and trusted sources.

2. Regularly update your operating system and all installed applications.

3. Use reliable security software to detect and block malware.

The crucial point is users should be cautious about downloading software from unverified websites and avoid using pirated software, as these are common vectors for malware distribution. Staying informed about the latest cybersecurity threats and adopting good digital hygiene practices can also drastically reduce the risk of infection.




Bitcoin Heist Hits Japanese Exchange DMM Bitcoin

 



In a security breach, Japanese cryptocurrency exchange DMM Bitcoin announced the theft of approximately 4,502.9 Bitcoin, valued at around 48.2 billion yen (approximately $304 million). The incident marks one of the largest cryptocurrency heists in recent history.

The breach was detected on May 31, 2024, at approximately 1:26 p.m. when DMM Bitcoin identified an unauthorised leak of Bitcoin from its wallets. The exchange immediately took steps to mitigate the leak and implement additional security measures to prevent further unauthorised access. The company is still investigating the full extent of the damage.

DMM Bitcoin has reassured its customers that their Bitcoin deposits will be fully guaranteed despite the breach. However, the exchange has implemented several temporary restrictions on its services to enhance security. These measures include the suspension of new account openings, the processing of cryptocurrency withdrawals, and the placing of new buy orders for spot trading. Only sell orders will be accepted for spot trading, and new open positions for leveraged trading are also suspended, with only settlement orders being processed.


Impact on Customers

The company has informed customers that existing limit orders for both spot and leveraged trading will remain unaffected. However, withdrawals of Japanese yen may experience delays. DMM Bitcoin has apologised for the inconvenience caused and assured customers that their assets are secure.


Response and Analysis

Cryptocurrency security firm Elliptic has reported that this heist ranks as the eighth-largest crypto theft of all time. It is the most significant since the $477 million hack suffered by FTX in November 2022. Elliptic has also confirmed the identification of the wallets involved in the DMM Bitcoin attack.


Ongoing Investigation

DMM Bitcoin continues to work on understanding the details of the attack and has not yet provided specific information about how the breach occurred. The company remains focused on ensuring the security of its platform and protecting customer assets.

The broader cryptocurrency community will be closely monitoring the developments of this case and the measures taken by DMM Bitcoin to prevent future incidents.


LockBit Ransomware Group Challenges FBI: Opens Contest to Find Dmitry Yuryevich

 

LockBitSupp, the alleged administrator of the notorious LockBit ransomware group, has responded publicly to recent efforts by the Federal Bureau of Investigation (FBI) and international law enforcement to identify and apprehend him. 

Following the restoration of previously seized domains, law enforcement authorities identified Dmitry Yuryevich Khoroshev as the mastermind behind LockBit operations in a recent announcement. This revelation was accompanied by official sanctions from the U.S., U.K., and Australia, along with 26 criminal charges that collectively carry a maximum sentence of 185 years imprisonment. 

Furthermore, the U.S. Justice Department has offered a substantial $10 million reward for information leading to Khoroshev's capture. Despite these developments, LockBitSupp has vehemently denied the allegations, framing the situation as a peculiar contest on the group's remaining leak site. LockBitSupp has initiated a contest on their leak site, encouraging individuals to attempt contact with Dmitry Yuryevich Khoroshev. They assert that the FBI has misidentified the individual and that Khoroshev is not associated with LockBitSupp. 

The ransomware admin suggests that the alleged identification mistake may have arisen from cryptocurrency mixing with their own funds, attracting the attention of law enforcement. The contest invites participants to reach out to Khoroshev and report back on his well-being, with a reward of $1000 offered for evidence such as videos, photos, or screenshots confirming contact. Submissions are to be made through the encrypted messaging platform Tox, using a specific Tox ID provided by LockBitSupp.  

Additionally, LockBitSupp has shared multiple links to LockBit-associated file-sharing services on the dark web, presumably for individuals to archive details and submit as contest entries. They have also listed extensive personal details alleged to belong to Dmitry Khoroshev, including email addresses, a Bitcoin wallet address, passport, and tax identification numbers. Amidst the contest announcement, LockBitSupp expressed concern for the individual mistakenly identified as them, urging Khoroshev, if alive and aware, to make contact. 

This unusual move by LockBitSupp challenges the assertions made by law enforcement agencies and highlights the complex dynamics of the cyber underworld, where hackers openly taunt their pursuers. LockBitSupp emphasized that the contest will remain active as long as the announcement is visible on the blog. They hinted at the possibility of future contests with larger rewards, urging followers to stay updated for further developments. 

The announcement was uploaded and last updated on May 9, 2024, UTC, leaving the public and cybersecurity community anticipating further developments. Recent indictments have identified Khoroshev as the mastermind behind LockBit operations since September 2019. The LockBit group is alleged to have extorted over $500 million from victims in 120 countries, with Khoroshev reportedly receiving around $100 million from his involvement in the activities.

Crypto’s New Cybersecurity Initiative Led by Justine Bone

 



The cryptocurrency sector is on the brink of a paradigm shift in cybersecurity as it gears up to launch Crypto ISAC (Information Sharing and Analysis Center), under the adept leadership of cybersecurity expert Justine Bone. Bone, acclaimed for her crucial role in instigating recalls of vulnerable medical devices, brings over two decades of expertise to the forefront, promising a formidable defence against cyber threats within the existing institution of digital assets.  

Set to make its debut at CoinDesk's prestigious Consensus 2024 event in Austin, Texas, Crypto ISAC is backed by a consortium of founding members, including major exchanges, stablecoin issuers, and custody firms. This collaborative effort marks an essential moment in the industry's journey towards fortifying security measures in light of persistent hacking incidents and unlawful activities.

The inception of Crypto ISAC stems from a collective acknowledgment within the cybersecurity community of the urgent need for a centralised platform to facilitate seamless information sharing and in-depth analysis. Bone, in an exclusive interview with CoinDesk, stressed upon the turning role of ISACs as trusted intermediaries in establishing collaboration and rapid responses to emerging security threats.

Drawing inspiration from the community-driven principles of neighbourhood watch programs, ISACs serve as vital means bridging the gap between public and private sector entities. By aligning itself with established sectors such as healthcare and finance, Crypto ISAC aims to elevate the credibility of the crypto industry while shoring up defences in order to combat cyber threats. 

With a diverse membership comprising crypto-native companies, investors, and cybersecurity solution providers, Crypto ISAC endeavours to engineer a robust ecosystem for active threat mitigation. They are leveraging a rigorously vetted information-sharing protocol, the platform ensures the timely dissemination of threat intelligence to empower members to preemptively address evolving cyber threats.

Bone's illustrious career trajectory, spanning notable roles at Dow Jones and Bloomberg, accentuates her leadership prowess in steering Crypto ISAC towards effective cybersecurity governance. The organisation's pursuit of FedRAMP readiness further underscores its commitment to delivering top-tier services.

As the launch date for Consensus approaches, members eagerly anticipate gaining access to a comprehensive collection of information on potential threats. With a focus on working together, being transparent, and staying strong, Crypto ISAC promises to bring a new level of security and trust to the cryptocurrency world.