This week, we were engaged in 67 incidents. Here are the reported losses of the incidents we dealt with by category:
1) Fake support caller: $8M
2) Protocol compromise: $2.32M + 703 ETH
3) Seed compromise: $6.74M
4) Infrastructure exploit $1.23M
5) Social engineering: $517k
6) Phishing: $267k + 1,358 SOL
7) Malware: $180k
What we collected
- 3,293 phishing domains
- 3,316 indicators published
- 193 wallets
Fake Support Callers
Fake support callers stole $8M, the largest category for us this week. In these cases, victims were contacted by someone posing as support and socially engineered into allowing attackers into their Gmail inboxes and CEX accounts.
- tickets-ledger[.]com
- keys-tangem[.]com
- 2519042-apple[.]com
- 2651732-apple[.]com
Protocol & Infrastructure Compromises
13 reports with losses totally $3.56M + 703 ETH:
- DEX: 670 ETH
- Rollup: $2M
- Key/infra compromise: $500k
- Infra drain: $330k
- MPC node: $311k
- DEX: $190k
- Bridge: $118k
- Server: $69.7k
DPRK
We worked 2 cases this week with no losses, including a fake Teams link and a Telegram ATO report.
New UNC1069 domains
- channeling[.]site
- cn03web[.]live
- cn03web[.]us
- idealchat[.]forum
- infozoom[.]live
- interzoom[.]net
- teamslive[.]us[.]com
- tenmslize[.]com
- teumslize[.]com
- texmslize[.]com
- zoomspace[.]uk
SINT-69
We responded to an uncategorized intrusion set using fake Zoom links.
4 new domains:
- 03in[.]us
- 04mweb[.]us
- 04webr[.]us
- livecom[.]app
Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it.If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate
If you require a direct data feed from SEAL-ISAC, contact us at [email protected].