During the last week, we responded to 65 distinct incidents. Losses by category:
1) Rug pull reported with $31M at risk
2) Seed compromise: $3.66M + 1.06 BTC + 0.7 ETH
3) Fake support caller: $1.01M
4) Protocol compromise: $875K
5) Social engineering: $175K
6) DPRK intrusion: $86.7K
7) Malware: $75K
8) Wallet compromise: $65K
What we collected
- 4,083 phishing domains
- 4,116 indicators published
- 61 wallets
⚠️ Be careful on Google when searching for hardware wallet applications. Attackers often impersonate those brands in Google results. Related, we wrote about malicious ads in Google search results back in April here.
IOCs
29 of the 65 reports we analyzed included seed compromises, but the root cause for each remains largely unknown.
Some of these users were talked out of their seed using tactics like fake-support domains:
- viewcases-ledger[.]com
- viewcases-trezor[.]io
- helpphantom[.]com
- il-apple[.]com
We also published a blog post about fake support voice calls last week here.
🚨 New fake podcast invite meeting pages. Don't download any third party conferencing software if you do not want to be hit by AMOS stealer.
- kakaoweb08talk[.]com
- mefex[.]space -> AMOS hash: d0be8ae2210ba2ccebae63ad13c95d6788a31e94f20d9784d2cd35e10f314b3a
We've previously covered fake video conferencing applications here.
Protocol and Infrastructure
We responded to with a total of $936K in recorded losses:
1) Card product: $570K
2) Contract bug victim: $305K
3) Wallet backend: $40.5K
4) Lending protocol exploit: $20.5K
🚨 LLM-driven research and infrastructure exploits become more common each week. Rug pulls and exit scams: 4 reports, including one project with $31M of investor funds at risk.
DPRK
We engaged on 3 cases, including two UNC1069 fake meeting invites with no reported losses. The 3rd case was a $86.7K key compromise.
We identified 7 new high-confidence UNC1069 domains:
- teampcsoft[.]com
- teamscloud[.]us[.]com
- teannslives[.]com
- teans-lives[.]com
- teensliwe[.]com
- us05cloud[.]co
- us05cloud[.]live
Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it.If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate
If you require a direct data feed from SEAL-ISAC, contact us at [email protected].