QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$2 000 USD
JANUARY 2019
GLOBAL
NONE
DESCRIPTION OF EVENTS
"CryptoGlobe has reported on several instances where viruses and malware were deployed to steal cryptocurrency.
One scenario involved cryptojacking software buried in [a] fake copy of a torrented movie that would redirect crypto payments whenever possible. The malicious software would scan websites for cryptocurrency addresses and then replace them with ones owned by the attackers. The virus would also falsify search results and create fake advertisements."
"A malicious Windows shortcut file posing as a movie via The Pirate Bay torrent tracker can trigger a chain of mischievous activities on your computer, like injecting content from the attacker into high-profile web sites such as Wikipedia, Google and Yandex Search or by stealing cryptocurrency."
"The exploit suite, found in a fake copy of the movie The Girl in the Spider’s Web (garnering a 40% on Rotten Tomatoes), targets the Windows operating system only. While very robust, the exploit can only target fast-clickers, as the malicious file is not even a media playing filetype, but instead a .LNK shortcut. Bleepingcomputer cited security experts in saying that “weaponized .LNK files are common in pirated content.”"
"The file opens many attack vectors. One of them produces fake ads and search results on Google and Yandex, by hijacking both Chrome and Firefox browsers to do its bidding, and downloads extensions it needs to function. It deviously redirects searches for things like “spyware” to custom, fake anti-spyware software which is in fact yet more malicious software."
"The malicious activity extends to other web pages, including Google and Yandex search results, and on Wikipedia entries. Another goal is to monitor web pages for Bitcoin and Ethereum wallet addresses and replaces them with others belonging to the attacker.
To do this, the malware modifies registry keys to disable Windows Defender protection if Microsoft's antivirus is enabled. It also forcibly installs in Firefox an extension called 'Firefox Protection' and hijacks the Chrome extension called 'Chrome Media Router', with the ID "pkedcjkdefgpdelpbcmbmeomcjbeemfm.""
"Wikipedia is also targeted when users visit the site, with a fake donation box injected into the page that appears presenting bitcoin and ether addresses (neither has seemed to phish too much coin)." "If the victim goes to Wikipedia, the malware's injection mechanism inserts a fake donation banner that states Wikipedia now accepts cryptocurrency donations and provides two cryptocurrency addresses to send "donate" to."
Malware was discovered distributing via a malicious LNK file, which installed malware on the user's computer when they tried to download a torrent for the popular hacking movie The Girl In The Spider's Web. This malware would replace cryptocurrency address, insert ads on many websites, and create a fake Wikipedia donation banner with the attacker's cryptocurrency wallet addresses. A small amount of funds were generated through the Wikipedia donations and it's unclear how well the other methods worked.
Malicious Browser Extension Racks Up Stolen Bitcoin From Unsuspecting Users | Cryptoglobe (Dec 28)
Crypto-Stealing Virus Found in Torrented Movie File, Targeting Windows | Cryptoglobe (Oct 27)
Fake Movie File Infects PC to Steal Cryptocurrency, Poison Google Results (Oct 27)
Spoofing search results and infecting browser extensions: Razy in search of cryptocurrency | Securelist (Oct 27)
THE GIRL IN THE SPIDER'S WEB - Official Trailer (HD) - YouTube (Oct 27)
Address: 1LVcPYWqCjsAyACk7Pf9tcbHYuzF6K94T7 (Oct 27)
Address 0x33a7305ae6b77f3810364e89821e9b22e6a22d43 | Etherscan
(Oct 27)
Ethereum Price History and Historical Data (Dec 21)
