Before we jump into our regularly-scheduled stats, we want to spend a minute on incident response related to malicious Ledger hardware wallet implants (CryptoBilis). We processed 15 individual reports from Ledger users and counted $12.5M lost across incidents. We continue to track it as its own incident type.
We already see an uptick in Ledger-themed attacks, exploiting the unfolding incident and users migrating their funds:
- ledgerscan[.]com (fake support calls): ~$1M loss
- Google ad to a fake Ledger Live setup page: $217K loss
- Ledger Live app swapped for malware: 10 BTC loss
Now, back to our regularly-scheduled stats...
Recorded losses by incident category:
1) CryptoBilis: $12.5M
2) Cause unknown: $4M
3) Protocol compromise: $1.2M
4) Fake support caller: $1.08M
5) Malware: $1M + 10 BTC
6) DPRK intrusion: $655K
7) Seed compromise: $498K + 2 BTC + 278 SOL
What we collected
- 6,109 phishing domains
- 6,136 indicators published
- 163 wallets
Protocol and infrastructure: 7 reports = $1.24M
- Protocol hacks - $1M, plus one with no figure
- Token hook - $114.9K
- Vault approval drain - $86K
- Operator key - $40K
- Team infra compromise, DNS hijack - no figure
- ClickFix fake Discord verification malware - $900K: guildstack[.]net
DPRK
One UNC1069 fake Teams call, resulting in $385K lost. One $270k seed compromise; DPRK suspected.
UNC1069 phishing infrastructure:
- teamoftenuse[.]com
- teanrisliue[.]com
- tearns-liue[.]com
Older C2 servers tied to new UNC1069 phishing deployments:
- check02id[.]com
- 188.227.197[.]143
SINT-69
An uncategorized intrusion set, remains active after an infrastructure migration.
New fake Zoom/Teams domains:
- 02webz[.]us
- 02zweb[.]us
- 05zweb[.]us
- 06webz[.]us
- 06zweb[.]us
- micvosoft[.]com
- teamlives[.]app
Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it.If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate
If you require a direct data feed from SEAL-ISAC, contact us at [email protected].