Hot wallets targeted.
Use ransom payment to avoid detection.
Private keys, seed phrases, and wallet address are not safe.
Introduction:
Microsoft is warning of an emerging threat targeting internet-connected cryptocurrency wallets, signaling a departure in the use of digital coins in cyberattacks.
Details:
The tech giant dubbed the new threat ‘cryware,’ with the attacks resulting in the irreversible theft of virtual currencies by means of fraudulent transfers to an adversary-controlled wallet. Cryware are information stealers that collect and exfiltrate data directly from non-custodial cryptocurrency wallets, also known as hot wallets. Hot wallets, unlike custodial wallets, are stored locally on a device and provide easier access to cryptographic keys needed to perform transactions, more and more threats are targeting them.
Currently:
Earlier this year, Kaspersky disclosed the Lazarus Group targeted crypto companies with malware designed to drain funds out of hot wallets.
Cryware encompasses the following threats:
Cryptojackers that surreptitiously consume a target’s device resources to mine cryptocurrency.
Ransomware campaigns that make use of cryptocurrency as a ransom payment to avoid detection.
Information stealers (e.g., Mars Stealer, RedLine Stealer, Arkei, and Raccoon) that are being increasingly upgraded to siphon hot wallet data alongside other valuable information stored in the system.
ClipBankers (aka clippers) that steal cryptocurrency during transactions by monitoring the clipboard and replacing the original wallet address with the attacker’s address.
Additional Security Info:
Such information-stealing attacks aim to extract hot wallet data such as private keys, seed phrases, and wallet addresses, thereby allowing the threat actor to initiate rogue transactions and move funds to another wallet. Alternatively, cybercriminals have also been observed to leverage techniques like memory dumping to display the private keys in plaintext, keylogging to capture keystrokes entered by a victim, or designing lookalike wallet websites to trick users into entering their private keys.
Closing:
To mitigate such threats, Microsoft is recommending users and organizations to lock hot wallets when not trading, disconnect sites connected to a wallet, avoid storing private keys in plaintext, and verify the value of the wallet address when copying and pasting the information. Cryware signifies a shift in the use of cryptocurrencies in attacks: no longer as a means to an end but the end itself.
Reference link for the full story:
Microsoft Warns of “Cryware” Info-Stealing Malware Targeting Crypto Wallets
This information is brought to you by Vectech Solutions, The Gold Standard in Cybersecurity
#microsoft #cryware #cryptowallets
