Cryptosteler for macOS, hotel Wi-Fi hacking, and a massive data leak: the week's top cyber threats
An analytical review of key incidents in the field of digital security over the past seven days. The focus is on key generation vulnerabilities, new attack vectors on macOS, international operations against cybercrime, and compromise of critical infrastructure.
Defective random number generator results in $5.7 million loss
A critical error in the CryptoJS library used to create seed phrases has led to a large-scale series of attacks on cryptocurrency owners. The CryptoJS.lib.WordArray.random() function, written more than ten years ago, generated keys with catastrophically low entropy. The actual brute-force space was reduced from 2^128 to 2^39 for 128-bit and from 2^256 to 2^47 for 256-bit phrases.
Attackers, using ordinary hardware, were able to guess keys and withdraw funds. The attack was carried out in two waves: on May 27, 431 accounts totaling approximately $3.14 million were drained, and between May 30 and July 13, another 522 wallets were compromised, bringing hackers an additional $2.55 million. Users of the Bitcoin, Ethereum, Tron, Rootstock, and Polygon networks were affected.
The vulnerable code was used in at least five wallets, including NanChat and Bitcoin Libre. However, as experts emphasize, simply updating the software will not solve the problem. A seed phrase created using a weak generator remains compromised forever, even when imported into a hardware wallet. This is a fundamental issue requiring complete migration to new addresses.
Sophisticated macOS crypto-stealer with partial withdrawal functionality
Researchers have discovered a new infostealer for macOS distributed through ClickFix phishing schemes. The malware, written in Go, disguises itself as system processes and is capable of stealing passwords, Apple Keychain data, and intercepting transactions.
The uniqueness of this virus lies in its cryptocurrency module. It does not drain the wallet entirely but instead discreetly redirects only a certain percentage of the transaction amount to the attacker's address. This approach allows attackers to parasitize victims' accounts for a long time without raising suspicion. The malware targets Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple.
According to my data, the management infrastructure of this stealer is linked to the Russian company Aeza Group, which had previously been sanctioned for providing bulletproof hosting to ransomware operators.
Sentence for the creator of Ransom Cartel
The U.S. Department of Justice has sentenced 40-year-old Belarusian citizen Maxim Silnikov, known in shadowy circles as J.P. Morgan. He was found guilty of creating and managing the infrastructure of the Ransom Cartel ransomware, which operated under the CaaS (Crime-as-a-Service) model.
From 2021 to 2023, his syndicate attacked at least 18 companies, causing damages exceeding $6.7 million. Silnikov was arrested in Spain but escaped and was detained while attempting to cross the border of Belarus. He faces 16 years in prison. Notably, the Ransom Cartel code bore strong similarities to the REvil ransomware, indicating a possible connection between Silnikov and that group.
Data leak of 100,000 UK police officers
The ransomware group ExfilSquad hacked the UK's Police National Legal Database (PNLD). As a result of the attack, contact details of more than 100,000 officers and criminal justice system employees were compromised, as well as 21,000 citizens who used the Ask the Police service.
The attackers exfiltrated 1.9 GB of information (approximately 135,000 records) and are demanding a ransom to prevent the publication of the full data set. PNLD representatives claim that confidential information about crime victims and witnesses was not affected, but the very fact of such a large-scale leak raises serious concerns.
Surveillance of VIP guests via hotel Wi-Fi
Microsoft experts link the CaptiveCrunch campaign to the Russian group Midnight Blizzard (APT29). Hackers compromised Wi-Fi authentication pages in hotels and replaced DNS settings, redirecting users to phishing pages for Microsoft 365 or sites using ClickFix tactics.
The attacks used two new malware variants: the CornFlake trojan written in Go with espionage capabilities, and the ChocoShell stealer on PowerShell operating in memory. Targets included diplomats, top executives, and defense industry engineers. Specialists recommend treating all public Wi-Fi networks in hotels as compromised by default and using mobile internet or a reliable VPN.
My expert assessment: the main takeaway of this week is that even "proper" use of crypto wallets does not guarantee security if key generation was initially compromised. The industry needs to reconsider entropy verification standards in popular libraries, and users need to be extremely cautious with any prompts to execute commands in the terminal, even if they look like system notifications.