Diffcoin
Menu

Category: cryptogiggle

Angel Drainer exploited the Ledger Connect Kit (855670622173) The latest report by SlowMist on the Ledger Connection Kit exploit yesterday shows that the hacking group Angel Drainer was responsible for the attack which resulted in a minimum loss of $600,000. SlowMist says in a post about X that “Angel Drainer used smart contracts to control the domains for malicious JavaScript files.” Ledger Connect Kit Attacked: Read about the Zapper, SushiSwap and Balancer. What is the Angel Drainer? SlowMist gave the crypto-community detailed insight into Angel Drainer tactics earlier in October. Angel Drainer was initially recognized as a relatively low-profile Web3 phishing group. However, it later focused on larger projects. It launched attacks against the DeFi Protocol Balancer and Web3 Community Platform Galxe on 19 September. SlowMist’s report explains that “after analysis we discovered that the group’s main method of attack was social engineering targeting domain service providers.” Once the criminals obtain the relevant domain account access, they then manipulate DNS resolution to redirect users towards fake websites. According to the report, data from ScamSniffer cybersecurity firm estimated that more than 3,000 domains are involved in Angel Drainer phishing. Source: Medium SlowMist SlowMist analysis shows that these domains have been registered since January 2023. The site that impersonated “Fight Out”, a Web3 project game, was linked with an email address associated with 107 phishing websites. The sites included a wide range of NFTs, authorization management tools such as RevokeCash and exchanges, like Gemini. They also covered cross-chain links, like Stargate Finance. This address was the source of the first transaction in May. SlowMist’s October report also highlights numerous phishing websites targeting the public chain Arbitrum as well as the NFT projects Pollen, Blur NFT Marketplace, the Uniswap Exchange, and others. What is the cost of Angel Drainer services? SlowMist’s Angel Drainer Service Offer includes a $40,000 fee and a deposit of $40,000. It also offers a draining strategy log, full customization, an “excellent log system”, as well as other features. Angel Drainer promotes their services also in Russian. It does not matter if the X profile is associated with the real Angel Drainer or the fake one, the account states that “for us, first and foremost is our name. And of course, when our community feels happy.” Prioritizing reputation above financial gain. Source: Medium SlowMist Angel Drainer rewards its customers who have earned the most money with Angel Drainer by giving them expensive NFTs such as BAYCs or MAYCs. According to SlowMist’s preliminary estimations, Angel Drainer had collected at least $2,000 in fees as of October. Some of the profits were transferred to various platforms, including Binance, eXch Bybit OKX Tornado Cash and others. Loch Debunks Blast Connection to Inferno Drainer Rumors Angel Drainer is known for its exploits such as the Balancer DNS and Galxe DNS attacks. The Balancer incident was caused by malicious JavaScript being injected into the app.balancer.fi front-end user interface. The users were unknowingly approving malicious transactions. This resulted in the attackers transferring over $350,000 through phishing. In Galxe, criminals impersonated Dynadot as the domain service provider and gained unauthorized access the DNS of the domain account. Nearly 1,120 people who interacted with the fake site ultimately lost almost $270,000. Angel Drainer has now targeted Ledger. A renowned maker of cold crypto and hardware wallets. The Ledger Connect Kit was exploited by the phishing group, affecting the interfaces on connected applications such as Balancer (which has been affected before by Angel Drainer), SushiSwap and Revoke.cash. Zapper also suffered. At least $600,000 in user funds were stolen. SlowMist, in collaboration with Scam Sniffer’s team, used characteristics of Angel Drainer (an utility that supports the detection of domains hosting phishing sites targeting Web3 users) to identify thousands phishing websites. The goal of this collaborative effort is to reduce the likelihood that Web3 users will fall victim to phishing and experience asset loss. SlowMist used Urlscan to collect phishing sites. Researchers have added the contract addresses that the Angel Drainer Group uses to control the domain access of malicious JS. These addresses can be found on Dune’s dedicated dashboard as well as GitHub. cryptogiggle

Angel Drainer exploited the Ledger Connect Kit (855670622173) The latest report by SlowMist on the Ledger Connection Kit exploit yesterday shows that the hacking group Angel Drainer was responsible for the attack which resulted in a minimum loss of $600,000. SlowMist says in a post about X that “Angel Drainer used smart contracts to control the domains for malicious JavaScript files.” Ledger Connect Kit Attacked: Read about the Zapper, SushiSwap and Balancer. What is the Angel Drainer? SlowMist gave the crypto-community detailed insight into Angel Drainer tactics earlier in October. Angel Drainer was initially recognized as a relatively low-profile Web3 phishing group. However, it later focused on larger projects. It launched attacks against the DeFi Protocol Balancer and Web3 Community Platform Galxe on 19 September. SlowMist’s report explains that “after analysis we discovered that the group’s main method of attack was social engineering targeting domain service providers.” Once the criminals obtain the relevant domain account access, they then manipulate DNS resolution to redirect users towards fake websites. According to the report, data from ScamSniffer cybersecurity firm estimated that more than 3,000 domains are involved in Angel Drainer phishing. Source: Medium SlowMist SlowMist analysis shows that these domains have been registered since January 2023. The site that impersonated “Fight Out”, a Web3 project game, was linked with an email address associated with 107 phishing websites. The sites included a wide range of NFTs, authorization management tools such as RevokeCash and exchanges, like Gemini. They also covered cross-chain links, like Stargate Finance. This address was the source of the first transaction in May. SlowMist’s October report also highlights numerous phishing websites targeting the public chain Arbitrum as well as the NFT projects Pollen, Blur NFT Marketplace, the Uniswap Exchange, and others. What is the cost of Angel Drainer services? SlowMist’s Angel Drainer Service Offer includes a $40,000 fee and a deposit of $40,000. It also offers a draining strategy log, full customization, an “excellent log system”, as well as other features. Angel Drainer promotes their services also in Russian. It does not matter if the X profile is associated with the real Angel Drainer or the fake one, the account states that “for us, first and foremost is our name. And of course, when our community feels happy.” Prioritizing reputation above financial gain. Source: Medium SlowMist Angel Drainer rewards its customers who have earned the most money with Angel Drainer by giving them expensive NFTs such as BAYCs or MAYCs. According to SlowMist’s preliminary estimations, Angel Drainer had collected at least $2,000 in fees as of October. Some of the profits were transferred to various platforms, including Binance, eXch Bybit OKX Tornado Cash and others. Loch Debunks Blast Connection to Inferno Drainer Rumors Angel Drainer is known for its exploits such as the Balancer DNS and Galxe DNS attacks. The Balancer incident was caused by malicious JavaScript being injected into the app.balancer.fi front-end user interface. The users were unknowingly approving malicious transactions. This resulted in the attackers transferring over $350,000 through phishing. In Galxe, criminals impersonated Dynadot as the domain service provider and gained unauthorized access the DNS of the domain account. Nearly 1,120 people who interacted with the fake site ultimately lost almost $270,000. Angel Drainer has now targeted Ledger. A renowned maker of cold crypto and hardware wallets. The Ledger Connect Kit was exploited by the phishing group, affecting the interfaces on connected applications such as Balancer (which has been affected before by Angel Drainer), SushiSwap and Revoke.cash. Zapper also suffered. At least $600,000 in user funds were stolen. SlowMist, in collaboration with Scam Sniffer’s team, used characteristics of Angel Drainer (an utility that supports the detection of domains hosting phishing sites targeting Web3 users) to identify thousands phishing websites. The goal of this collaborative effort is to reduce the likelihood that Web3 users will fall victim to phishing and experience asset loss. SlowMist used Urlscan to collect phishing sites. Researchers have added the contract addresses that the Angel Drainer Group uses to control the domain access of malicious JS. These addresses can be found on Dune’s dedicated dashboard as well as GitHub.

According to the latest update on yesterday’s Ledger Connect Kit exploit by the cybersecurity team SlowMist,…

December 16, 2023 4 min read