GIGABYTE

RansomEXX

Ransomware

GIGABYTE, a computer hardware giant, hit by RansomEXX ransomware, exposing 112GB of data

Hardware giant Gigabyte hit by RansomEXX ransomware forced them to shut down their systems, compromising 112 GB of data...

07-Aug-2021

3 min read

No content available.

CoinDCX

Crypto

CoinDCX hit by $44M crypto hack—customer assets safe, recovery bounty launched, ...

In a seismic jolt to the Indian cryptocurrency landscape, CoinDCX, the country’s leading digital asset exchange, has confirmed a devastating security breach resulting in the theft of nearly **\$44 million (approx. ₹378 crore)** from one of its operational accounts. The hack, which unfolded in mid-July 2025, has raised pressing questions about the security of centralized cryptocurrencies, risk management practices, and the future of India’s fast-growing Web3 sector. ## Timeline of the CoinDCX Breach: Key Events and Quick Facts * **July 18, 2025:** Unusual activity is detected on one of CoinDCX’s internal operational accounts, triggering an internal investigation. * **July 19–20, 2025:** CoinDCX isolates suspicious wallet activity and mobilizes incident response. * **July 21, 2025:** CoinDCX confirms the breach publicly, revealing a total loss of approximately **\$44 million**. * **Ongoing:** Forensic investigations, law enforcement involvement, and a record-breaking recovery bounty are launched. **At a Glance:** * **Assets Stolen:** \~\$44 million in crypto * **Targeted Wallet:** Internal operational account (not user funds) * **Customer Impact:** No user assets compromised * **Response:** Incident contained, services continued, recovery efforts underway ## What Exactly Happened? ### Target: The Operational Wallet, Not Customer Funds Unlike many high-profile crypto hacks that siphon assets from user wallets or hot exchange wallets, the CoinDCX attackers zeroed in on an **internal operational account used for liquidity provisioning**. This distinction is crucial—**customer funds held in custodial wallets remained untouched**. **Attack Vector:** * The specific TTPs (tactics, techniques, and procedures) employed by the attackers are still under investigation, but preliminary analysis suggests the compromise of private keys associated with the operational wallet. * Attackers leveraged blockchain bridges—primarily **Solana-Ethereum bridges**—to quickly move stolen assets across networks, obscuring the crypto’s trail and complicating asset recovery. **Key Stolen Assets:** * \~4,443 ETH (Ethereum) * 155,830 SOL (Solana) * Plus an unspecified amount of other ERC-20 and SPL tokens ## Immediate Aftermath: Swift Response and Containment ### How CoinDCX Responded * **Immediate Isolation:** Upon detection, CoinDCX promptly isolated all internal wallets and suspended operational account activities to prevent further losses. * **Law Enforcement Notification:** The incident was reported to **CERT-In** (India’s Computer Emergency Response Team) and local cybercrime authorities. * **Transparent Disclosure:** CoinDCX leadership published a series of transparent statements, updating users and partners via social media, official blogs, and direct communication. ### User Impact and Service Continuity * **No Customer Asset Losses:** CoinDCX reassured users that “all customer assets are completely safe,” highlighting robust custodial wallet security measures. * **Business as Usual:** The exchange remained operational with only minor disruptions to specific trading pairs linked to the affected operational wallet. ## Largest-Ever Crypto Bounty in India ### Launching a \$11 Million Recovery Bounty In a bold move, CoinDCX announced **India’s largest-ever crypto recovery bounty**—offering up to **25%** of any recovered funds (potentially \~\$11 million) to individuals or organizations that can assist in tracing and retrieving the stolen assets. This open call aims to harness the global blockchain security community, white-hat hackers, and even “ethical” actors with insights into the breach. ### Collaborative Investigations CoinDCX’s response includes: * **Partnerships with blockchain analytics firms** to monitor on-chain transactions and trace the movement of stolen crypto. * **Close cooperation with other exchanges** globally to freeze or flag suspicious assets if they re-enter mainstream trading platforms. * **Ongoing engagement with law enforcement** at both national and international levels. ## Expert Reactions: Security Lessons and Industry Ramifications ### Security Analysts Weigh In > “This is not simply a hack—it’s a wake-up call for all centralized exchanges,” said Ajeet Khurana, veteran crypto analyst and former head of the Blockchain and Crypto Assets Council (BACC). “Operational wallets often lack the same level of multi-signature protection as customer-facing wallets, making them attractive targets.” ### Common TTPs in Similar Breaches * **Private Key Compromise:** Human error, phishing, or insufficient access controls can expose wallet private keys. * **Bridge Exploitation:** Rapid transfer of assets across chains using decentralized bridges (Solana-Ethereum, etc.) to obfuscate the trail. * **Mixers and Tumblers:** Use of privacy protocols to further hide the origin and movement of stolen assets. ### Calls for Enhanced Security * **Multi-signature wallets** and **hardware-based key storage** for all high-value operational wallets * **Continuous monitoring** using AI-driven blockchain analytics tools * **Independent third-party audits** for wallet and infrastructure security ## CoinDCX’s Official Statement and Community Response ### CoinDCX Founders Speak Sumit Gupta, CEO of CoinDCX, issued a strong assurance: > “Our highest priority is the safety of user assets and maintaining trust. While the loss is significant, CoinDCX’s financial reserves allow us to absorb this without impacting our customers.” ### Community and Industry Response * **Widespread Support:** Many users applauded CoinDCX for transparency and swift action, contrasting it with slower, less communicative responses seen in other hacks. * **Skepticism Remains:** Security experts caution that repeated breaches—India saw the **WazirX hack of \~\$235 million in July 2024**—underscore persistent vulnerabilities in the country’s centralized crypto infrastructure. --- ## India’s Crypto Security Landscape in 2025 ### India’s Track Record and Industry Trends * **Second-Largest Crypto Breach in India:** Only the WazirX 2024 incident surpasses CoinDCX’s loss. * **\$2.17 Billion Stolen Globally in H1 2025:** CoinDCX’s hack is part of a global surge in crypto thefts, with ByBit and other exchanges also hit hard this year. * **Regulatory Scrutiny Intensifies:** The Reserve Bank of India (RBI) and Ministry of Finance are reportedly revisiting guidelines for centralized exchanges in the wake of repeated hacks. ### Impact on Market Sentiment * **Short-Term Confidence Dip:** Market sentiment towards Indian exchanges took a brief hit, but rapid recovery and user assurance have stemmed panic. * **Renewed Focus on Decentralization:** The incident has reignited debate on the merits of self-custody, decentralized exchanges (DEXs), and non-custodial solutions. The \$44 million CoinDCX breach is more than just another crypto hack; it’s a defining moment for India’s digital asset industry. As CoinDCX battles to recover lost assets and restore faith, the entire sector must evolve—embracing next-generation security practices, regulatory oversight, and a culture of transparency. The true test lies not just in how CoinDCX responds, but in whether India’s Web3 ecosystem can rise stronger and smarter from this latest challenge.

22-Jul-2025

6 min read

LAMEHUG

GenAI

CERT-UA discovers LAMEHUG malware using the Qwen2.5-Coder AI model to generate m...

Ukraine's Computer Emergency Response Team (CERT-UA) has [uncovered](https://cert.gov.ua/article/6284730) a sophisticated malware campaign that represents a paradigm shift in cyber warfare tactics. The newly discovered **LAMEHUG malware** leverages artificial intelligence to dynamically generate malicious commands, marking the first confirmed instance of threat actors weaponizing large language models for command-and-control operations. This groundbreaking attack, attributed to the Russian state-sponsored group **[APT28](https://www.secureblink.com/cyber-security-news/polish-government-hacked-apt-28-s-devious-lure)** (also known as Fancy Bear), demonstrates how cyber-criminals are evolving to incorporate cutting-edge AI technology into their arsenals, potentially revolutionizing the threat landscape for organizations worldwide. ## LAMEHUG's AI-Driven Architecture ### Core Functionality and LLM Integration LAMEHUG represents a technical milestone in malware development, built entirely in **Python** and designed to exploit the **Qwen2.5-Coder-32B-Instruct** model developed by Alibaba Cloud. The malware's most distinctive feature is its ability to generate commands through natural language processing rather than relying on pre-programmed instructions. - Python-based payload - Qwen2.5-Coder-32B-Instruct via Hugging Face API - Text-to-code conversion using LLM - SFTP and HTTP POST protocols - Documents, Downloads, Desktop folders ### Qwen2.5-Coder Model Capabilities The weaponized AI model represents state-of-the-art coding capabilities, featuring: - **32.5 billion parameters** with 31.0B non-embedding parameters - **64-layer transformer architecture** with RoPE, SwiGLU, and RMSNorm - **131,072 token context length** for complex code generation - **Multi-language support** across 40+ programming languages - **Performance parity** with GPT-4o on coding benchmarks The model's sophisticated architecture enables **code generation, reasoning, and fixing** capabilities that LAMEHUG exploits for dynamic command creation, making traditional signature-based detection methods ineffective. ## Phishing Campaign Methodology ### Distribution Mechanism The LAMEHUG campaign employs a multi-stage attack vector targeting high-value Ukrainian government officials: **Initial Compromise:** - **Compromised email accounts** used to impersonate ministry officials - **ZIP archives** containing malware payloads - **Three distinct variants**: Додаток.pif, AI_generator_uncensored_Canvas_PRO_v0.9.exe, and image.py **Social Engineering Elements:** - Legitimate-appearing government correspondence - Authority-based trust exploitation - Time-sensitive content to encourage immediate action ### Command Generation Process LAMEHUG's revolutionary approach to malware operation involves: 1. **Text-based command descriptions** embedded in the malware 2. **API calls** to Hugging Face's Qwen2.5-Coder-32B-Instruct model 3. **Dynamic code generation** based on natural language instructions 4. **Real-time command execution** on compromised systems This methodology allows attackers to: - **Bypass signature-based detection** through dynamic code generation - **Adapt attack strategies** without malware updates - **Maintain operational security** through legitimate API usage ## APT28 Attribution and Threat Intelligence ### Actor Profile and Capabilities **APT28 (Fancy Bear)** represents one of Russia's most sophisticated cyber espionage units, with confirmed attribution based on: - **Tactical, Techniques, and Procedures (TTPs)** consistent with historical operations - **Target selection** aligning with Russian intelligence priorities - **Infrastructure patterns** matching known APT28 campaigns - **Medium confidence attribution** by CERT-UA analysts **Known APT28 Aliases:** - Fancy Bear - Forest Blizzard - Sednit - Sofacy - UAC-0001 ### Strategic Implications The integration of AI technology into APT28's operations signals: - **Technological advancement** in state-sponsored cyber capabilities - **Evolution beyond traditional malware** development approaches - **Increased sophistication** in command-and-control mechanisms - **Potential for widespread adoption** across threat actor ecosystem ## Defensive Evasion: AI-Powered Security Bypass ### Legitimate Infrastructure Exploitation LAMEHUG's use of **Hugging Face API infrastructure** for command-and-control presents unique challenges: **Evasion Techniques:** - **Legitimate service abuse** to blend with normal enterprise traffic - **API-based communication** appearing as standard AI development activity - **Cloud infrastructure utilization** for improved availability and resilience - **Dynamic payload generation** frustrating traditional analysis methods ### Skynet Malware Concurrent research by Check Point reveals complementary AI evasion techniques in the **Skynet malware**, which employs **prompt injection** to manipulate AI-based security analysis tools. **Skynet's Anti-AI Techniques:** - **Prompt injection strings** designed to fool LLM analyzers - **Embedded instructions** requesting "NO MALWARE DETECTED" responses - **Adversarial content** targeting AI-powered security solutions - **Proof-of-concept implementation** demonstrating attack feasibility ## Technical Countermeasures and Detection Strategies ### Network-Level Defenses **API Traffic Monitoring:** - Monitor outbound connections to `huggingface.co` domains - Implement rate limiting for AI service API calls - Deploy anomaly detection for unusual LLM query patterns - Establish baseline metrics for legitimate AI development traffic **Behavioral Analysis:** - Track dynamic code generation patterns - Monitor Python execution in enterprise environments - Implement sandboxing for AI-generated code execution - Deploy machine learning models to identify AI-generated malware ### Endpoint Protection Strategies **File System Monitoring:** - Implement real-time scanning of Documents, Downloads, and Desktop directories - Monitor for unusual file access patterns targeting TXT and PDF documents - Deploy integrity checking for sensitive document repositories - Establish baseline access patterns for user directories **Process Behavior Analysis:** - Monitor Python interpreter execution with network connectivity - Track API calls to external AI services - Implement application whitelisting for AI development tools - Deploy advanced persistent threat detection for dynamic payloads ## Industry Impact and Future Threat Landscape ### Paradigm Shift in Malware Development The LAMEHUG discovery represents a fundamental transformation in cybersecurity threat modeling: **Immediate Implications:** - **Traditional signature-based detection** becomes insufficient - **AI-powered security solutions** face adversarial challenges - **Threat intelligence sharing** requires new analytical frameworks - **Incident response procedures** need AI-aware methodologies **Long-term Considerations:** - **Democratization of advanced malware** through AI accessibility - **Escalation of cyber conflict** through AI arms race dynamics - **Evolution of defensive technologies** to counter AI-powered threats - **Regulatory implications** for AI service provider responsibilities ### Organizational Risk Assessment **High-Risk Sectors:** - Government agencies and defense contractors - Critical infrastructure operators - Financial services institutions - Healthcare organizations with sensitive data **Mitigation Priority Matrix:** | Risk Level | Mitigation Strategy | Implementation Timeline | |------------|-------------------|------------------------| | **Critical** | API traffic monitoring | Immediate (0-30 days) | | **High** | Behavioral analysis deployment | Short-term (30-90 days) | | **Medium** | Staff training and awareness | Medium-term (90-180 days) | | **Low** | Policy updates and documentation | Long-term (180+ days) | Organizations must rapidly adapt their defensive strategies to address this new class of threats that leverage legitimate AI services for malicious purposes. The success of APT28's AI-powered campaign against Ukrainian government targets serves as a stark warning that traditional cybersecurity approaches are insufficient against dynamic, AI-generated threats. As threat actors continue to weaponize increasingly sophisticated AI models, the cybersecurity community must evolve its detection, analysis, and response capabilities to match this new level of adversarial innovation. The future of cybersecurity now depends on our ability to defend against not just human creativity in malware development, but the amplified capabilities that artificial intelligence brings to the threat landscape. Organizations that fail to recognize and prepare for this paradigm shift risk being defenseless against the next generation of AI-powered cyberattacks.

18-Jul-2025

6 min read

607 Fake Telegram Sites Spread Android Malware, Janus Exploit Puts Millions at R...

A sophisticated Android malware campaign has been discovered targeting users through 607 malicious domains posing as official Telegram download pages. The operation, uncovered by BforeAI's PreCrime Labs, leverages [typosquatting](https://www.secureblink.com/cyber-security-news/bumblebee-malware-intensifies-corporate-network-attacks-via-seo-poisoning-typosquatting-and-d-do-s-tactics) techniques, QR code redirections, and exploits the critical Janus vulnerability affecting Android devices running versions 5.0 through 8.0. ## Campaign Overview and Scale ### Discovery and Attribution BforeAI's threat intelligence team identified this large-scale operation in recent weeks, revealing one of the most extensive fake app distribution campaigns targeting the popular messaging platform. The research demonstrates how cybercriminals are becoming increasingly sophisticated in their approach to distributing mobile malware. ### Infrastructure Analysis The malicious infrastructure spans across multiple components: | **Component** | **Details** | |---------------|-------------| | **Total Domains** | 607 confirmed malicious domains | | **Primary Registrar** | Gname registrar | | **Hosting Location** | Primarily China-based servers | | **Target Languages** | Chinese, with SEO-optimized phrases | | **APK Variants** | Two versions: 60MB and 70MB | ### Domain Distribution by TLD The campaign strategically utilized various top-level domains to maximize credibility and distribution reach: - **.com domains**: 316 (52% of total) - **.top domains**: 87 (14% of total) - **.xyz domains**: 59 (10% of total) - **.online domains**: 31 (5% of total) - **.site domains**: 24 (4% of total) - **Other TLDs**: 90 (15% of total) The high concentration of .com domains suggests a deliberate strategy to enhance perceived legitimacy. ## Technical Attack Methodology ### Typosquatting and Social Engineering The attackers employed sophisticated typosquatting techniques, creating domains that closely mimic official Telegram branding: - **teleqram** (missing 'g') - **telegramapp** (added 'app') - **telegramdl** (appended 'dl') - **apktelegram** (reversed order) These domains redirect users to a central distribution site, `zifeiji.asia`, designed to replicate Telegram's official appearance with authentic-looking favicons, colors, and download buttons. ### Distribution Vectors The campaign utilizes multiple distribution methods: 1. **QR Code Redirections**: Users scan QR codes that redirect to malicious download pages 2. **SEO Manipulation**: Page titles contain Chinese phrases like "Paper Plane Official Website Download" to improve search engine visibility 3. **Social Media Links**: Direct links shared across various platforms 4. **Blog-Style Pages**: Phishing sites disguised as personal blogs or unofficial fan pages ## Janus Vulnerability Exploitation ### Technical Overview The malicious APKs exploit the Janus vulnerability ([CVE-2017-13156](https://nvd.nist.gov/vuln/detail/cve-2017-13156)), a critical Android security flaw that affects devices running Android 5.0 through 8.0. This vulnerability allows attackers to inject malicious code into legitimate APK files without altering their cryptographic signatures. ### Vulnerability Mechanics The Janus exploit works by: - **Signature Bypass**: Malicious apps appear legitimate to Android's security verification - **Code Injection**: Harmful code is inserted into otherwise valid applications - **Detection Evasion**: Security scanners fail to identify the malicious components - **Widespread Impact**: Affects approximately 74% of Android devices globally ### Payload Capabilities Once installed, the malicious Telegram apps demonstrate extensive capabilities: - **Remote Command Execution**: Attackers can execute arbitrary commands on infected devices - **Data Exfiltration**: Access to external storage, contacts, and sensitive information - **Network Communication**: Uses cleartext protocols (HTTP, FTP) for data transmission - **Media Manipulation**: Interacts with MediaPlayer and multimedia files - **Socket Communication**: Receives and processes remote instructions ## Infrastructure and Persistence Mechanisms ### Firebase Exploitation The campaign leverages Firebase infrastructure for command and control operations: - **Database Endpoint**: `tmessages2.firebaseio.com` (now deactivated) - **Reactivation Risk**: The database could be reactivated by registering a new Firebase project with the same name - **Persistent Threat**: Older malware versions would automatically reconnect to reactivated endpoints ### Tracking and Analytics The malicious infrastructure incorporates sophisticated tracking capabilities: - **JavaScript Tracking**: `ajs.js` script hosted on `telegramt.net` - **Device Fingerprinting**: Collects browser and device information - **User Behavior Analysis**: Monitors user interactions and preferences - **Targeted Delivery**: Contains code for displaying Android-specific download banners ## Impact Assessment ### Geographic Distribution While the campaign primarily targets Chinese-speaking users, the global reach of the infrastructure poses risks to international users. The use of common domain extensions and multiple hosting locations suggests potential for widespread distribution. ### User Risk Profile The campaign particularly endangers users who: - Download apps from unofficial sources - Use older Android devices (versions 5.0-8.0) - Are less familiar with security best practices - Respond to QR code prompts without verification ## Security Implications ### Supply Chain Risks This campaign highlights critical vulnerabilities in the mobile app ecosystem: - **Third-Party Distribution**: Risks associated with downloading apps outside official stores - **Legacy Vulnerabilities**: Continued exploitation of older Android security flaws - **Social Engineering**: Sophisticated impersonation of trusted brands ### Detection Challenges The campaign's sophistication presents significant challenges for traditional security measures: - **Signature Validation**: Janus vulnerability bypasses standard signature verification - **Dynamic Infrastructure**: Rapid deployment and takedown of malicious domains - **Legitimate Appearance**: High-quality impersonation of official services ## Organizational Defense Strategies ### Technical Countermeasures Organizations should implement comprehensive protection strategies: 1. **Automated Domain Monitoring**: Deploy systems to detect suspicious domain registrations 2. **APK Analysis**: Implement multi-source threat intelligence scanning for APK files 3. **Network Filtering**: Block delivery of APK and SVG attachments where not business-essential 4. **URL Verification**: Scan URLs and hash values against multiple threat intelligence sources ### User Education and Awareness Critical user education components include: - **Official Source Verification**: Training users to download apps only from official stores - **QR Code Caution**: Educating users about QR code security risks - **Brand Impersonation Recognition**: Teaching users to identify legitimate vs. fraudulent sites - **Device Security**: Promoting regular security updates and patching ## Regulatory and Industry Response ### Current Enforcement Actions The scale of this campaign has prompted various industry responses: - **Google Play Protect**: Enhanced scanning for malicious APK files - **Registrar Cooperation**: Increased scrutiny of bulk domain registrations - **Threat Intelligence Sharing**: Collaboration between security vendors ### Long-term Implications This campaign demonstrates the need for: - **Enhanced Mobile Security Standards**: Stronger verification for app distribution - **Improved Legacy Support**: Better security updates for older Android versions - **Industry Collaboration**: Coordinated response to large-scale campaigns ## Mitigation Recommendations ### Immediate Actions Organizations should take immediate steps to protect against this campaign: 1. **Block Known Indicators**: Implement blocking for identified domains and IP addresses 2. **Update Security Policies**: Restrict APK installations from unknown sources 3. **Monitor Network Traffic**: Watch for connections to known malicious infrastructure 4. **User Communication**: Issue advisories about the campaign to user communities ### Long-term Strategy Comprehensive protection requires sustained effort: - **Threat Intelligence Integration**: Incorporate IOCs into security monitoring systems - **Continuous Monitoring**: Regular assessment of domain registration patterns - **Security Awareness Programs**: Ongoing user education about mobile security - **Vendor Collaboration**: Work with security vendors for enhanced protection The 607-domain fake Telegram campaign represents a significant leap in mobile malware sophistication. The exploitation of the Janus vulnerability, combined with advanced social engineering techniques and distributed infrastructure, creates a formidable threat to Android users worldwide. This campaign’s ability to bypass traditional security measures highlights the urgent need for better mobile security practices at both the organizational and individual levels.

17-Jul-2025

6 min read

Our Product

Resource Library

Subscribe to Our Weekly Threat Digest

Contact Us

PRODUCT

threatspyBulk IP/Domain Lookup

threatspy

Bulk IP/Domain Lookup

SOLUTIONS

By Industry

Healthcare

Healthcare

Education

Education

IT & Telecom

IT & Telecom

By Role

Government

Government

CISO/CTO

CISO/CTO

DevSecOps

DevSecOps

RESOURCES

Threat Feed

Threat Feed

Threat Research

Threat Research

White Paper

White Paper

SB Blogs

SB Blogs

COMPANY

Our Story

Our Story

Our Team

Our Team

Career

Career

Press And Media

Press And Media

Contact Us

Contact Us

GIGABYTE

RansomEXX

Ransomware

GIGABYTE, a computer hardware giant, hit by RansomEXX ransomware, exposing 112GB of data

Related Articles

CoinDCX

Crypto

CoinDCX hit by $44M crypto hack—customer assets safe, recovery bounty launched, ...

LAMEHUG

GenAI

CERT-UA discovers LAMEHUG malware using the Qwen2.5-Coder AI model to generate m...

Telegram

607 Fake Telegram Sites Spread Android Malware, Janus Exploit Puts Millions at R...

Product

Solutions

Resources

Company

Find Us Online

contact@secureblink.com

@ Copyright 2025 Secure Blink. All rights reserved.

threatspy
Bulk IP/Domain Lookup