Crypto news

The week was packed with events in the field of digital security: from the dismantling of a major fraud scheme in Ukraine to the innovative use of blockchain in the arsenal of ransomware operators. I'm breaking down the key incidents shaping the threat landscape.

Ukrainian cyber police shut down the Money 24/7 scheme

Ukrainian law enforcement neutralized the activities of the fraudulent network Money 24/7, which masqueraded as a legitimate currency and crypto-asset exchange service. The organizers created a full-fledged "illusion of reliability": quality web resources, an active Telegram channel, a registered trademark, and even an office with a cash register. Clients submitted a request online, after which they were invited to the office to hand over cash, but the promised cryptocurrency never reached their wallets. To buy time and delay police reports, victims were partially refunded or given "written guarantees." During searches in seven regions, more than 20 million hryvnias in cash were seized. The organizer faces up to 12 years in prison with confiscation of property.

FBI warns of a wave of attacks stealing intimate photos

The Bureau and the National Collegiate Athletic Association are recording a surge in cyberattacks aimed at stealing personal photos and videos from cloud accounts. Attackers use phishing SMS and emails, scaring victims with account lockouts. After gaining access to sensitive material, hackers demand ransom, threatening publication. Notably, even after payment, the data is often sold on the dark web, leading to a new wave of harassment and extortion. Student-athletes have become a particular target.

Attack aboard Delta Air Lines: hackers from DEF CON

On a Delta Air Lines flight from Las Vegas to Atlanta carrying attendees of the DEF CON 34 hacking conference, an incident occurred involving the onboard Wi-Fi. Attackers sent spoofed data packets, disconnecting passengers' devices from the legitimate network, and deployed their own network, "Delta WiFi Fast," with a phishing login page aimed at stealing Google passwords. The crew urgently cut power to the Wi-Fi for 30 minutes. After landing, police questioned suspects and seized portable hacking equipment. Flight safety was never threatened, as the passenger network is isolated from navigation systems.

Jewelbug: the double life of Chinese hackers

The group Jewelbug, known for sophisticated cyberespionage, has also been found involved in crypto fraud. Symantec analysts linked the financially motivated portion of the attacks to a legitimate Chinese SEO company, indicating a "hackers-for-hire" model. As part of the espionage campaign, the group compromised the webmail of 15 government ministries in the Middle East and Asia, using JavaScript code to steal session cookies. In parallel, it turned out, they used neural networks to generate fake articles on hundreds of fake domains mimicking Binance and OKX, with botnets pushing these sites to the top of search engines. The group's database contained over a million logs, 580,000 stolen cookies, and thousands of credentials. A custom Rust-based trojan named ClientKing was used to infect Linux servers.

DeadLock: ransomware operators move to the Polygon blockchain

The ransomware group DeadLock, with nearly a hundred victims, has radically changed its infrastructure, fully transitioning to decentralized solutions to resist takedowns. Instead of a traditional ransom note, the virus leaves an HTML file that is a fully functional standalone web application. JavaScript code inside this file directly interacts with smart contracts on the Polygon blockchain to rotate proxy server addresses. If law enforcement blocks one address, hackers only need to update a record in the smart contract, and the chat works again. Posts about breaches are also tied to smart contracts and distributed via the decentralized Wasabi protocol. Technically, the malware uses hybrid cryptography with Curve25519 and XChaCha20, and to evade detection, it pauses the process under high system load.

Cyberattack on a Polish combined heat and power plant: a new penetration vector

CERT Polska has revealed details of an attack on a combined heat and power plant providing heat to about 50,000 residents. The uniqueness of the incident lies in the fact that the attackers penetrated critical infrastructure through the private cellular network of the local power grid operator. Starting at a wind farm, the hackers went through a firewall and a Teltonika RUTX50 cellular router to reach a WAGO PFC200 controller protected only by a factory password. Through it, they tunneled into the plant's internal network, switched Siemens S7 controllers to stop mode, and changed passwords, leading to the physical shutdown of a steam turbine. The attackers methodically destroyed evidence by resetting equipment settings to factory defaults.

My comment: DeadLock's move to Polygon smart contracts is a wake-up call for the entire security industry. Decentralization, which was supposed to be our shield, is now becoming a sword in the hands of cybercriminals. Traditional methods of combating ransomware infrastructure, based on blocking domains and servers, are losing effectiveness. The industry urgently needs to develop new counter-strategies, possibly at the level of analyzing malware behavior and blockchain transaction chains.