DeadLock moves to Polygon, fake exchangers in Ukraine, and a Wi-Fi attack on a plane: cybersecurity digest
The week in cyberspace was eventful: from the dismantling of fraudulent networks in Ukraine to innovative methods by extortionists embracing decentralized technologies. I break down the key events shaping the threat landscape.
Ukraine: Underground Network of Fake Exchanges
Law enforcement shut down the activities of the fraudulent network Money 24/7, which masqueraded as a legitimate currency and crypto-asset exchange service. The scheme was meticulously planned: the perpetrators created high-quality websites, actively ran a Telegram channel, registered a trademark, and even rented an office with a cash register to create an illusion of reliability. Clients who submitted online applications to buy cryptocurrency were invited to the office, where they handed over cash but never received the digital assets. To stall for time, the fraudsters partially refunded funds and issued "written guarantees." During more than 20 searches across seven regions, over 20 million hryvnias in cash were seized, and the organizer faces up to 12 years in prison. Damages from one episode alone exceeded 1.6 million hryvnias.
DeadLock: Extortion via Blockchain
The DeadLock group, which targets companies in the US, Europe, and Turkey, has revolutionized its infrastructure. Instead of traditional servers, hackers now use smart contracts on the Polygon network. The ransom note is a standalone HTML application that directly interacts with the blockchain to rotate proxy server addresses. If law enforcement blocks one address, operators simply update the record in the smart contract, and communication with the victim is restored. This makes the extortionists' infrastructure nearly indestructible. Technically, the malware uses hybrid encryption with Curve25519 and XChaCha20, and can also mask its activity by reducing CPU load. This is a troubling signal: we are witnessing cybercriminals adapting advanced technologies to create systems resistant to blocking.
Attack on Delta Air Lines Flight
On board flight 591, traveling from Las Vegas to Atlanta after DEF CON 34, a Wi-Fi incident occurred. Attackers sent spoofed data packets, disconnecting passengers from the legitimate network, and deployed a fake access point called Delta WiFi Fast with a phishing login page to steal Google passwords. The crew powered down the onboard Wi-Fi for 30 minutes. After landing, police interrogated suspects and seized equipment. Fortunately, the aircraft's navigation systems were isolated, and flight safety was never threatened.
Chinese Espionage and Crypto Scam
Analysts uncovered the dual activities of the Jewelbug group. On one hand, hackers attacked government institutions in the Middle East and Asia, stealing data through compromised webmail systems. On the other, they simultaneously ran a large-scale crypto fraud campaign, using neural networks to generate fake articles and botnets to promote counterfeit sites masquerading as Binance and OKX. The group's database contained over 580,000 stolen cookies and thousands of credentials. This is a striking example of the convergence of state-sponsored cyber espionage and financial crime.
Poland: Cyberattack on a Combined Heat and Power Plant
CERT Polska revealed details of an attack on a combined heat and power plant supplying heat to 50,000 people. The attackers infiltrated the system through a private cellular network of the power grid operator, exploiting vulnerabilities: lack of MFA at a wind power station and a default password on a WAGO controller. Ultimately, they halted the steam turbine by switching Siemens S7 controllers to stop mode. This is the first documented case of using such an attack vector on industrial facilities.
My comment: DeadLock's shift to blockchain is not just a trend but a paradigm shift in the fight against cybercrime. Traditional methods of blocking domains and servers are becoming useless. The security industry will need to develop new approaches, possibly including smart contract monitoring and cooperation with network validators. The attack on the Polish CHP plant is another reminder that critical infrastructure remains vulnerable due to human factors and outdated security standards.