This week in cybersecurity: a new prank Trojan in Russia, a major data breach at the European Commission, and updates on cryptocurrency theft.
This week’s cybersecurity highlights include the emergence of a new Trojan in Russia, a significant data breach affecting the European Commission, and updates on cryptocurrency theft.
- A new prank Trojan named CrystalX has been found in Russia, capable of altering crypto addresses and mocking users.
- Research has uncovered that control server addresses for cryptocurrency theft software are being concealed on platforms like Spotify and Chess.com.
- A hacker has been indicted for stealing over $53 million from the Uranium cryptocurrency exchange.
- An updated stealer targeting seed phrases has been identified, affecting both Apple and Android devices.
New Prank Trojan Emerges in Russia
Kaspersky Lab has reported a new Trojan named CrystalX, currently being distributed through a Cybercrime-as-a-Service model via ads on social media platforms such as Telegram and YouTube. This malware can steal login credentials from various platforms, alter clipboard content to replace cryptocurrency wallet addresses, and record audio and video from infected devices.
Notably, the Trojan features a section that allows it to mock users in real-time, including commands that can change desktop backgrounds, rotate screen orientations, and disable input devices. Leonid Bezvershenko, a senior expert at Kaspersky, warns that the Trojan is evolving and will likely attract more victims as its reach expands.
To protect against such threats, experts advise downloading software only from official sources and maintaining updated antivirus programs.
Cryptocurrency Theft Software Found on Popular Platforms
Solar 4RAYS researchers have identified that hackers are using profiles on Spotify and Chess.com to hide addresses for control servers linked to the MaskGram stealer. This malware is designed to extract sensitive information, including account details and cryptocurrency from various applications. The software employs social engineering tactics to trick users into downloading it, disguising itself as legitimate programs.
This method of using public profiles to store server information allows the malware to appear as normal user activity, thereby evading detection.
Charges Filed Against Hacker for $53 Million Theft
Jonathan Spalletta has been charged with stealing over $53 million from the Uranium Finance exchange and laundering the proceeds. The hack, which took place in April 2021, forced the exchange to shut down. Following a recent search, law enforcement recovered approximately $31 million in cryptocurrency from his residence. Spalletta allegedly used the stolen funds to purchase collectibles, including rare trading cards and coins.
Updated Seed Phrase Stealer Discovered
Kaspersky researchers have also unveiled a new version of the SparkCat malware targeting cryptocurrency users on both iOS and Android platforms. This stealthy malware masquerades as harmless apps while searching for wallet seed phrases in photo galleries. The iOS version poses a significant global threat, while the Android version has improved obfuscation techniques to avoid detection.
Data Breach at the European Commission
The European Commission has confirmed a data leak associated with a cyberattack on its Europa.eu platform, attributed to the ShinyHunters ransomware group. Although the Commission reported no operational disruptions, the attackers claimed to have stolen over 350 GB of sensitive data, including databases and confidential documents. They have published some of this information on their dark web leak site.
As cyber threats evolve, organizations are urged to bolster their defenses against such attacks.
