Discover and read the best of Twitter Threads about #dangerouspassword
Most recents (3)
⚠️ Heads up y'all—we're seen a huge increase in the # of ultra-targeted spearphishes lately.
The most deadly one? A Google Doc share that appears to come from *someone you know* about *something you're interested in*
It won’t be flagged and looks super legit.
DO NOT CLICK! 🙏
The most deadly one? A Google Doc share that appears to come from *someone you know* about *something you're interested in*
It won’t be flagged and looks super legit.
DO NOT CLICK! 🙏
This campaign is the work of #Lazarus / #APT38 / #DangerousPassword / #T444
aka the same crew that compromised Ronin, Harmony, bZx, Bondly, EasyFi, mngr, Arthur0x, Hugh Karp, etc. etc. etc.
Their spear-phishing methods are diverse, targetted, and hard-to-detect.
aka the same crew that compromised Ronin, Harmony, bZx, Bondly, EasyFi, mngr, Arthur0x, Hugh Karp, etc. etc. etc.
Their spear-phishing methods are diverse, targetted, and hard-to-detect.
Recent subject lines / filenames:
Fast Changes in NFT Price (Protected)
Investor Demo Day-Animoca Brands (Protected)
Jump Crypto Investment Agreement
New Credit Investment Opportunity
Spirit Blockchain Capital 2023 - Pitch Deck
Opening the file *may* result in something like:
Fast Changes in NFT Price (Protected)
Investor Demo Day-Animoca Brands (Protected)
Jump Crypto Investment Agreement
New Credit Investment Opportunity
Spirit Blockchain Capital 2023 - Pitch Deck
Opening the file *may* result in something like:
1/ @deBridgeFinance has been the subject of an attempted cyberattack, apparently by the Lazarus group.
PSA for all teams in Web3, this campaign is likely widespread.
PSA for all teams in Web3, this campaign is likely widespread.
2/ The attack vector was via email, with several of our team receiving a PDF file named “New Salary Adjustments” from an email address spoofing mine.
3/ We have strict internal security policies and continuously work on improving them as well as educating the team about possible attack vectors.
Most of the team members immediately reported the suspicious email, but one colleague downloaded and opened the file
Most of the team members immediately reported the suspicious email, but one colleague downloaded and opened the file
#ICYMI, here's a #threatintel related🧵👇 by me on @USTreasury advisory on DPRK IT workers' attempts to obtain employment while posing as non-North Korean nationals: home.treasury.gov/system/files/1… (1/?)
DPRK IT workers "engage in a wide range of IT dev work, such as: mobile & web-based apps, virtual currency exchange platforms & digital coins. Some
designed virtual currency exchanges or created analytic tools/apps for virtual currency traders & marketed their products." (2/?)
designed virtual currency exchanges or created analytic tools/apps for virtual currency traders & marketed their products." (2/?)
This reminds me, for example, of Marine Chain Token: (justice.gov/opa/pr/three-n…; justice.gov/opa/press-rele…), #AppleJeus (cisa.gov/uscert/ncas/al…) and, more recently, #TraderTraitor (cisa.gov/uscert/ncas/al…). #HIDDENCOBRA/#APT38 loves loves loves their crypto (3/?)
