This week, we responded to 62 incidents. Here are the reported losses of the incidents we dealt with by category:
1) Protocol compromise $13.71M
2) Other $953k
3) Malware $530k
4) Pig butchering $500k
5) Fake ads $270k
6) Seed compromise $263k
Plus 1.7 BTC and 14.2 ETH lost to DPRK-related incidents.
Observables collected:
- 3,192 phishing domains
- 4,793 phishing domains
- 4,844 indicators published
- 123 wallets
Trends:
1) A rising amount of infrastructure attacks (cloud environment, dependencies, API hacking, front ends, third party providers API) on crypto protocols are often powered by LLM agents.
2) Previously successful DPRK intrusions (6- 12 months old) are being re-activated. DPRK sweeps logs and checks if there's any valuable access left. Remember to periodically rotate credentials and revoke access of old employees.
3) LLMs are used to design and execute full attack chains, both for web application pentesting as well as malware campaigns.
Protocol compromises:
9 this week, totaling $13.71M. Rarely the contract itself:
- Wallet app $5.3M
- Exchange account $4.8M
- Lending market $3.53M
- HTLC contract $50K
- Withdrawal check bypass $28K
- Admin API takeover, contained
- ERC-7579 smart accounts, rollup exploit
DPRK
- A fake Teams invite cost 1.7 BTC and 5.7 ETH
- Fake job interview caught at $12K
- Fake interview caught at $0
Contagious Interview
- antfarmdao[.]com (Fake Company)
- theantfarm[.]tech
SINT-01 / TA444 / Konni
- squadlab[.]it (C2)
New UNC1069 domains
- interview[.]forum
- joinme[.]host
- linechats[.]com
- me-0live[.]com
- me-live[.]it[.]com
- microteam[.]it[.]com
- microteamhub[.]com
- onlinelives[.]xyz
- tecmslize[.]com
- termslize[.]com
- well-interview[.]com
- workclub[.]live
- workplace[.]forum
ClickFix:
10 new domains, $530K. Six used mshta:
- 5843-cf[.]com
- 9898-cf[.]com
- anthropicrbh[.]com
- gmecoinrbh[.]com
- nectarbnb[.]com
- thebitcounfoundation[.]com
Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it.If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate
If you require a direct data feed from SEAL-ISAC, contact us at [email protected].