CertiK Alert Profile picture
Apr 26 5 tweets 4 min read
#CryptoSecNewsAlert🚨

The @FBI is raising awareness on BlackCat ransomware-as-a-service (RaaS), which it said has attacked around 60 entities worldwide from November 2021 to March 2022.

The FBI released Flash No: CU-000167-MW

Read it all here👇

ic3.gov/Media/News/202… Image
@FBI Also called ALPHV and Noberus, the ransomware is notable for being the first-ever malware written in the #Rust programming language.

Rust is known to be memory safe and offer improved performance. rust-lang.org

Rust is also used by Solana docs.solana.com/developing/on-…
@FBI Rust offers the attackers opportunity to take advantage of a lower detection ratio from static analysis malware detection tools, which aren't adapted to all programming languages.

Rust is growing in the web3 space for EVM connected DAPPS as well
ethereum.org/en/developers/…
@FBI BlackCat's modus operandi involves the theft of victim data prior to the execution of the ransomware, w/ the malware often leveraging compromised user credentials to gain initial access to the target system.

Ransom payments are often in Bitcoin, Monero or other cryptocurrencies.
@FBI The FBI is urging orgs to:

review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts, take offline backups, implement network segmentation, apply software updates, and secure accounts with multi-factor authentication and more.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with CertiK Alert

CertiK Alert Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @CertiKAlert

Apr 17
We are seeing a possible exploit on @BeanstalkFarms - symbol $BEAN which has dropped 100%

#slippage

Address: 0xdc59ac4fefa32293a95889dc396682858d52e5db0x48f33863b1defc7b294717498c634ba9a5fb58a7

Be careful out there! Image
Flashloan attack on Beanstalk has drained their fund of approx $100 Million

Attacker wallet: etherscan.io/txs?a=0x1c5dcd…

“Publius” the discord owner has stated the project has no money to carry on and ‘its dead’.
The hacker has moved roughly $30M (~9700 #ETH) to @TornadoCash

Follow the funds yourself with SkyTrace: certik.com/skytrace/eth:0… Image
Read 8 tweets
Apr 13
#CommunityAlert 🚨

@ElephantStatus's Treasury contract experienced a #flashloan attack leading to a loss of around $11M. The Treasury contract is unverified and unaudited.

bscscan.com/address/0xd520…
The attacker took advantage of the redeem mechanism of the $TRUNK token, manipulated the price oracle to empower the token return, and stole ELEPHANT from the unverified Treasury contract.

Attack Steps 👇
1. The attacker deployed an attacker contract and borrowed $WBNB and $BUSD using flashloan from multiple pair pools.

2. Most of the borrowed WBNB was swapped for ELEPHANT to raise the price of ELEPHANT.
Read 6 tweets
Mar 17
#CommunityAlert 🚨

At 11:20:44 PM +UTC, around 379 #BNB (~$150K) was rugpulled by the $Elona deployer.

The deployer removed the liquidity and transferred 540 #BNB in total to Tornado Cash. Image
Steps:

Elona Deployer minted 1 trillion $Elona tokens:
bscscan.com/tx/0x9c6ccc909…

Deployer burned 500 billion tokens and added the other 500 billion as liquidity, along with 196.5 BNB: bscscan.com/tx/0x7d33e841e…
The deployer removed all the liquidity and got around 260,891,540,144.73 Elona and 379.38 BNB: bscscan.com/tx/0xa27da3c3f…

Deployer transferred all the BNB (382.83) to address 0xbff2d5d4e5a4a7b1859ac5edb010fdafe4ea92a8: bscscan.com/tx/0x54d0358e0…
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(