Identity

Million

Fortress

<figure> 
 <figcaption>
 Cover image via <a href="https://u.today/" rel="noopener noreferrer nofollow">U.Today</a> 
 </figcaption> 
</figure> 
Chinese crypto blogger and journalist Colin Wu has shared the details of the recent hack of <a href="https://u.today/ripples-newly-acquired-company-hit-by-hackers-heres-what-happened" rel="noopener noreferrer nofollow">crypto custodian Fortress Trust,</a> just recently acquired by Ripple blockchain giant. It became possible thanks to software developing company Retool, citing a story <a href="https://thehackernews.com/2023/09/retool-falls-victim-to-sms-based.html" rel="noopener noreferrer nofollow">by thehackernews.com</a>. 
The soft spot hit by the hackers here, according to Wu, was to do with the additional security system provided by a major authentication app. 
<h2 lang="en-GB" xml:lang="en-GB" id="27-accounts-on-fortress-trust-were-compromised">27 accounts on Fortress Trust were compromised</h2> 
According to Retool, the cyber criminals managed to compromise as many as 27 accounts on Fortress Trust crypto custody company. They succeeded in making this exploit after a targeted SMS (text)-based social engineering attack. 
<blockquote> 
 Retool has released details of a hack involving 27 crypto accounts, including how $15 million in cryptocurrency was stolen from Fortress Trust. Google Authenticator cloud sync function was the reason, the attacker took control of the Google account, thereby controlling the data…— Wu Blockchain (@WuBlockchain) <a href="https://twitter.com/WuBlockchain/status/1703678755385098470?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 18, 2023</a> 
</blockquote> 
According to Fortress Trust, the hackers used a Google account cloud synchronization feature that was introduced in the spring of this year. The company, based in San Francisco just like Ripple that bought it, stated that the feature mentioned above made the breach worse and referred to it as a "dark pattern." Retool called this type of synchronization "a novel attack vector," per the head of engineering at the company, Snir Kodesh. He stated that this multi-factor-authentication turned into single factor thanks to the update made by the internet search giant in April. 
The attack that occurred on Aug. 27 happened at the same time that Fortress Trust was moving its logins to Okta. 
<h2 lang="en-GB" xml:lang="en-GB" id="here-s-how-attack-began-and-here-s-who-stands-behind-it">Here's how attack began, and here's who stands behind it</h2> 
The hackers pretended to be one of the Fortress Trust IT team members when they started their SMS-phishing attack. They gave the recipients directions to follow a link that looked quite legitimate in order to help them with a payroll-related problem. 
One real staff member fell for this trick and went to a fake landing page, which then had them share their credentials. What happened next is that the villains again rang the same employee, pretending to be a member of the IT team (with the help of deep fake changing their voice) and told the staffer to pass them the code of multi-factor authentication (MFA). 
This code let the hackers add their own gadget to the Okta account of the victim, and after that, the culprits were able to make up their own MFA codes to access the account. In the end, having put smoke in the eyes of this employee, the hackers were further able to access all the 27 accounts mentioned above. The hackers changed the email addresses for those accounts, along with the passwords. As a result, a whopping <a href="https://u.today/millions-of-xrp-stolen-during-epic-exchange-hack-what-happened" rel="noopener noreferrer nofollow">$15 million worth of crypto</a> assets was lost. 
The way the attack was performed shows similar methods to the hacker calling himself Scattered Spider (aka UNC3944), who is believed to be an expert of a high level in phishing attacks.

Identity of Ripple's Fortress Trust Hacker Who Stole $15 Million in Crypto Revealed

Table of Contents

U_Today

Other articles published on Sep 18, 2023

Home Depot (NYSE: HD) Signals Reversal, Will HD Stock Hold $320?

Billion Dollar Partnership Between the US and Vietnam on AI

Crypto Gaming Should Go Beyond Just NFTs, Says Argus Labs CEO

Negative Sentiment Fuels Fears of ApeCoin Dipping Below $1 After $40M Unlock

Crypto starts the week with a bang

Why is Visa betting on Solana to conquer the crypto world?

Join our free newsletter for daily crypto updates!