mETH

Watcher.Guru: Currently unable to confirm the method of the hack, has contacted platform X

ChainCatcher news, Watcher.Guru posted on platform X that its account was hacked today. Two weeks ago, the team suspected that someone was attempting to breach the account and sent a message to X employees as a warning.According to their description, on March 5, a Telegram user sent them a link to an X article, which had the official X domain but contained an unusual path, suspected to be a social engineering attack method. Although the team did not find any obvious risks at that time, they still sent a message to X's cybersecurity head @cstanley, but did not receive a reply.On March 21 at 10:05 AM Beijing time, Watcher.Guru discovered that its account had unauthorized content published and deleted it within minutes, while logging out of all devices and resetting the password. However, since their "JUST IN" or "BREAKING" tweets automatically sync to social platforms like Telegram, Facebook, and Discord, the related content was automatically forwarded.Watcher.Guru stated that it cannot confirm whether this hacking incident was caused by that specific link, but similar incidents have recently occurred with db (@tier10k). Additionally, their account has 2FA enabled, no connected applications, and no API tokens detected being used to publish content.Currently, Watcher.Guru is still investigating the specific method of the breach and has contacted X officials for further clarification.

Slow Fog Cosine: Confirmed that the attacker of the CEX theft incident is the North Korean hacker group Lazarus Group, which has revealed its attack methods

ChainCatcher news, Slow Mist founder Yu Xian posted on social media, "Through forensic analysis and correlation tracking, we confirm that the attackers of the CEX theft incident are the North Korean hacker group Lazarus Group. This is a nation-state APT attack targeting cryptocurrency trading platforms. We have decided to share the relevant IOCs (Indicators of Compromise), which include some IPs of cloud service providers, proxies, etc. It is important to note that this disclosure does not specify which platform or platforms were involved, nor does it mention Bybit; if there are similarities, it is indeed not impossible."The attackers utilized pyyaml for RCE (Remote Code Execution), enabling the delivery of malicious code to control target computers and servers. This method bypassed most antivirus software. After synchronizing intelligence with partners, multiple similar malicious samples were obtained. The main goal of the attackers is to gain control over wallets by infiltrating the infrastructure of cryptocurrency trading platforms, thereby illegally transferring a large amount of cryptocurrency assets from the wallets.Slow Mist published a summary article revealing the attack methods of the Lazarus Group, and also analyzed their use of social engineering, vulnerability exploitation, privilege escalation, internal network penetration, and fund transfer tactics. At the same time, based on actual cases, they summarized defense recommendations against APT attacks, hoping to provide references for the industry and help more institutions enhance their security capabilities and reduce the impact of potential threats.

Supreme People's Procuratorate: Currently, telecom and internet fraud crimes are rampant, and virtual currency "money laundering" has become a mainstream method

ChainCatcher news, according to Jinshi reports, Du Xueyi, director of the Economic Crime Prosecution Office of the Supreme People's Procuratorate, stated during a guest appearance on the Supreme Procuratorate's director interview event on February 13 that the current situation of telecom network fraud crimes is still severe and complex, with a high incidence.First, the cross-border and monopolistic nature of fraud groups has emerged, with criminals setting up "industrial parks" and "technology parks" abroad, managing and controlling through means such as providing guarantees and armed protection, taking a cut or charging fees to obtain illicit funds, forming large criminal organizations.Second, the methods of fraud are increasingly diverse and complex, with combinations such as "pig butchering + false investment," "gambling fraud," and "fraud and extortion," which are more deceptive and have led to serious violent crimes such as intentional injury.Third, the modules of black industry crimes are becoming more stable, with criminal tools and software being simple and easy to use, resulting in a broader population being drawn into criminal activities. Fourth, the channels for funds are intertwined and concealed, with virtual currency "money laundering" becoming a mainstream method, helping criminals to transfer fraudulent funds in "small amounts and multiple transactions," making it difficult to trace back.
ChainCatcher Building the Web3 world with innovators