Crypto news

The week was packed with cybersecurity events directly impacting the crypto industry. From physical scams at "exchange" offices to using smart contracts to manage ransomware infrastructure, attackers continue to demonstrate sophistication and adaptability.

Ukrainian cyberpolice busted a network of fake Money 24/7 exchangers

Ukrainian law enforcement detained the organizer of a fraudulent scheme operating under the guise of a legitimate exchange service. The criminals created an illusion of reliability: quality websites, an active Telegram channel, a registered trademark, and even an office with a cash register. Clients who submitted an online application to purchase cryptocurrency were invited to this office, where they handed over cash but never received the digital assets.

To stall for time and prevent immediate police reports, the fraudsters partially returned funds in crypto and issued "written guarantees." During more than 20 searches across seven regions of the country, over 20 million hryvnias in cash, computer equipment, and documentation were seized. The organizer faces up to 12 years in prison with asset confiscation.

FBI warns of a wave of hacks targeting intimate photo theft

The Bureau has recorded a surge in attacks aimed at stealing personal photos and videos from social networks and cloud services. Student athletes are at particular risk. The scheme is standard: phishing SMS or emails demanding a "password reset." After the hack, hackers blackmail victims, threatening to publish the material. Notably, even after paying the ransom, the content is often sold on the darknet, leading to a new wave of harassment and extortion.

Cyberattack aboard a Delta Air Lines flight: DEF CON hackers in action

Delta Air Lines is investigating an incident on flight 591, traveling from Las Vegas to Atlanta. On board were participants of the DEF CON 34 hacking conference. The attackers forcibly disconnected passengers' devices from the legitimate Wi-Fi, deploying their own fake network, "Delta WiFi Fast," with a phishing login page to steal passwords. The crew cut off the onboard internet for nearly 30 minutes. Upon landing, police interrogated the suspects and seized their equipment. Fortunately, flight control systems were not affected.

Chinese Jewelbug hackers: the double life of spies and crypto fraudsters

Symantec analysts revealed details about the activities of the Jewelbug group, which combined cyberespionage against government structures with large-scale crypto fraud. By hacking the webmail of government agencies in the Middle East and Asia, the hackers used backdoors and malicious extensions. Simultaneously, they managed a network of hundreds of fake domains masquerading as Binance and OKX exchanges, promoting them to the top of search engines using botnets. Their arsenal includes a custom Rust-based trojan and the use of Google Docs to conceal malicious activity.

DeadLock ransomware goes decentralized on Polygon

The DeadLock ransomware group, with nearly a hundred victims in the US and Europe, has revolutionized its infrastructure. Instead of traditional servers, they use the Polygon blockchain. The ransom note is not a text file but a standalone HTML application that directly interacts with smart contracts. This allows hackers to rotate proxy server IP addresses and publish victim data in a decentralized manner, making blocking their infrastructure an extremely difficult task.

Technically, the malware uses hybrid encryption on Curve25519 and XChaCha20, masks its activity by pausing under high system load, and self-destructs after completing its task.

Cyberattack on a Polish thermal power plant: physical turbine shutdown

CERT Polska revealed details of an attack on a combined heat and power plant providing heat to 50,000 people. The uniqueness of the incident lies in the intrusion vector: through the private cellular network of the power grid operator. Exploiting vulnerabilities (lack of MFA, factory passwords on WAGO controllers), hackers paved the way to Siemens S7 industrial controllers, stopping a steam turbine. The attackers methodically destroyed evidence by resetting equipment settings. This is the first documented case of using such a vector against industrial facilities.

My analysis: The evolution of DeadLock toward using blockchain is a wake-up call for the entire security industry. Decentralizing the management of malicious networks nullifies traditional countermeasures based on blocking domains and servers. The industry needs to more actively develop proactive detection and behavioral analysis methods rather than relying on reactive measures. The incident in Poland also underscores the critical importance of basic security hygiene (MFA, changing default passwords) even in seemingly isolated network segments.