Seed phrase vulnerabilities, a macOS stealer with "intelligence," and a hunt for VIP guests: weekly cybersecurity digest
Over the past week, several landmark events have occurred in the world of digital security: from a fundamental flaw in key generation to sophisticated espionage in hotel Wi-Fi networks. I am breaking down the most high-profile incidents that should force a rethink of approaches to protecting assets and data.
Entropy collapse: $5.7 million stolen due to 12-year-old code
A major campaign dubbed Ill Bloom has exposed a critical vulnerability in random number generators. The problem lies in the CryptoJS.lib.WordArray.random() function, whose code was written more than a decade ago. When generating 128- and 256-bit seed phrases, it produced such weak entropy that the brute-force space shrank from cryptographically secure 2^128 and 2^256 to a paltry 2^39 and 2^47.
This allowed attackers to crack victims' keys using ordinary hardware. The attack was carried out in two waves: on May 27, 431 accounts were drained of $3.14 million, and from May 30 to July 13, another 522 wallets were hit for $2.55 million. Affected networks include Bitcoin, Ethereum (and EVM-compatible chains), Tron, Rootstock, and Polygon.
At least five wallets used the vulnerable code: NanChat, Bitcoin Libre, Bexo Wallet, as well as the closed projects RRWallet and Milo. Key takeaway: a simple app update will not save you — a seed phrase generated by a weak generator will remain compromised forever, even if imported into a hardware wallet.
macOS stealer with surgical precision
Researchers have discovered a new infostealer for macOS written in Go. The malware spreads through phishing pages using the ClickFix technique, disguises itself as system processes, and steals passwords from Keychain. Its unique feature is a module for working with cryptocurrencies.
Instead of fully draining a wallet, the virus intercepts transactions on Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple networks, redirecting only a set percentage of funds to the hacker's address. This allows attackers to parasitize victims' accounts for a long time without raising suspicion. The infrastructure is allegedly linked to the Russian company Aeza Group, previously sanctioned for Bulletproof hosting.
Sentence for the creator of Ransom Cartel
The U.S. Department of Justice has sentenced 40-year-old Belarusian citizen Maxim Silnikov, known as J.P. Morgan, for creating and operating the Ransom Cartel ransomware. The project, launched in 2021 under the CaaS model, bore significant similarity to REvil's code, indicating Silnikov's possible involvement in the core of that syndicate. From 2021 to 2023, Ransom Cartel attacked at least 18 companies, causing $6.7 million in damages and demanding $5.2 million in ransoms. Silnikov was arrested in Spain, escaped, but was caught while trying to cross the Belarusian border. He faces 16 years in prison.
Data breach of 100,000 British police officers
The ExfilSquad group hacked the UK's Police National Legal Database (PNLD). As a result, contact details of more than 100,000 police and criminal justice system employees were compromised, including names, email addresses, and departmental affiliations. The hackers exfiltrated 1.9 GB of information (~135,000 records) and are demanding a ransom to prevent the publication of the remaining data.
CaptiveCrunch: hotel Wi-Fi as a trap for VIPs
Microsoft links the large-scale CaptiveCrunch campaign to the Russian group Midnight Blizzard (APT29). The hackers compromise Wi-Fi equipment in hotels, spoof DNS, and redirect guests to Microsoft 365 phishing pages or ClickFix sites. Two new viruses are used: CornFlake (a Go-based trojan for espionage) and ChocoShell (a PowerShell stealer). The goal is to steal corporate credentials and spy on diplomats and top executives.
My opinion: the Ill Bloom incident is a wake-up call for the entire industry. It shows that "secure" cryptography can be nullified by outdated code. Users who used the aforementioned wallets need to immediately generate new seed phrases on verified hardware. And the CaptiveCrunch attack is a vivid example that in today's world, public networks are a battlefield, and trusting them without a VPN means voluntarily exposing your data.