This week, we engaged in 70 individual incidents. CryptoBilis, the malicious Ledger hardware wallet implant incident, is still producing losses with 3 new reports this week, $9.3M lost. Two victims of in-person robbery lost a combined $1.22M. Wrench attacks are on the rise.

Here are the reported losses by category:

1) CryptoBilis: $9.3M

2) Seed compromise $3.86M + 64.5 ETH + 0.3 BTC

3) Protocol compromise: $2M + 37.44 ETH

4) Account takeover: $1.6M

5) Wrench attacks: $1.22M

6) Malware: $316K + 0.47 BTC

7) Phishing: $284K

8) DPRK intrusion: $260K

What we collected

  • 2,393 phishing domains
  • 2,437 indicators published
  • 155 wallets

Protocol & Infrastructure

9 total reports:

  • Protocol compromise: 6 reports for a combined loss of $2M + 37.44 ETH (two of which lost $1M each)
  • Infrastructure takeover: $32.4K + 5 BTC loss
  • Insider threat: a contributor added his own address as a multisig signer.

DPRK

5 cases with a combined $260K lost:

  • 3 Contagious Interview fake job interview victims: $86K
  • 1 wallet compromise, campaign not yet identified: $174K
  • Polin Rider malware found in 13 of 928 repos of an open-source bounty program - no loss reported

New DPRK Infrastructure

UNC1069 fake meeting domains:

  • tearins-liues[.]com
  • tearms-liues[.]com
  • us05[.]cloud
  • us05cloud[.]com (lower confidence)
  • us05live[.]cloud (lower confidence)

Contagious Interview:

  • celestium[.]live
  • vantora[.]space
  • worldcupoutliners[.]world
💡
Contagious campaigns are baiting developers into execution of malicious payload during video conferences.

SINT-69, an uncategorized intrusion set, keeps minting fake Zoom/Teams domains:

  • 03nweb[.]us
  • 04webz[.]us
  • 05webz[.]us
  • web05z[.]us
  • lives[.]eu[.]com
  • teamlives[.]business
  • teamslive[.]uk[.]com
  • u06web[.]us
  • web06z[.]us
  • zoomwweb[.]us

Unclassified fake meeting pages:

  • meets-calls[.]com
  • msmeet[.]sbs
  • us89webzoom[.]us

Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it.If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate

If you require a direct data feed from SEAL-ISAC, contact us at [email protected].

The link has been copied!