Ethereum

United

Bitcoin

Read

Dutch cybersecurity specialists have linked a major cryptocurrency theft to the infamous Ebury botnet, responsible for compromising over 400,000 servers over a 15-year period. 
According to a <a href="https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-ebury-botnet-alive-growing-400k-linux-servers-compromised-for-cryptocurrency-theft-and-financial-gain/" target="_blank" rel="">report</a> from Slovakian cybersecurity firm ESET, the incident was initially uncovered during a 2021 investigation by the Dutch National High Tech Crime Unit (NHTCU). During this investigation, operatives found the Ebury botnet on a server linked to crypto theft. 
After this revelation, the Dutch crime unit collaborated with ESET, led by researcher&nbsp; Marc-Etienne Léveillé, who had been studying Ebury for over a decade. 
Ebury operators allegedly used a sophisticated attack dubbed adversary-in-the-middle (AitM) to steal the crypto funds. The attack transpires with the botnet intercepting network traffic and capturing login credentials and session information. 
“Cryptocurrency theft was not something that we’d ever seen them do before,” Léveillé noted. 
The botnet redirects this traffic to servers controlled by the cybercriminals, allowing them to access and steal cryptocurrency from the wallets of the victims. In its report, ESET revealed that over 100,000 remained infected as of 2023. 
Ebury specifically <a href="https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/" target="_blank" rel="">targets</a> Bitcoin and Ethereum nodes, making off with wallets and other valuable credentials. The botnet would steal the funds once the unsuspecting victims entered their credentials on the infected server. 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-us.googleusercontent.com/M1-1uegtrtuZcC3F9h2PhKGpKFeFnUolc_RXT8zw_WOtltMdUs4apCQNHgwd_8lIYZiQE18U62UmiiH8d3f3XHevW-oSX8NP-gGktAWugukPmupztw7NBrkq4bzpdcosIOz1gpC6RIw_I13uxbmlayk" alt="ESET and Dutch police expose Ebury botnet's cryptocurrency theft operations - 21">
 <figcaption class="wp-element-caption">
 Flowchart of Ebury’s attack on crypto wallets | Source: welivesecurity
 </figcaption>
</figure> 
Further, once a victim’s system was compromised, Ebury would exfiltrate credentials and use them to infiltrate related systems. The report identified a wide array of victims ranging from universities, enterprises, internet service providers, and cryptocurrency traders. 
The attackers also employ stolen identities to rent servers and deploy their attacks. As such, it is very difficult for law enforcement agencies to track down the identities of those behind this cybercrime racket. 
“They’re really good at blurring the attribution,” Léveillé added. 
 You might also like: <a href="https://crypto.news/crypto-com-disappointed-over-3m-fine-by-dutch-central-bank-plans-to-appeal/" rel=""> Crypto.com ‘disappointed’ over $3m fine by Dutch central bank, plans to appeal </a> 
One Ebury operator, Maxim Senakh, was arrested at the Finland-Russia border in 2015 and was extradited to the United States. The U.S. Department of Justice <a href="https://www.justice.gov/opa/pr/russian-citizen-sentenced-46-months-prison-involvement-global-botnet-conspiracy" target="_blank" rel="">charged</a> Senakh with computer fraud, to which he pleaded guilty in 2017. He was sentenced to four years behind bars. 
While the masterminds behind Ebury remain at large, the NHTCU has revealed that several leads are being pursued. 
Crypto thefts have become increasingly complicated over the years. Earlier this month, North Korean hackers <a href="https://crypto.news/north-korean-hackers-target-crypto-firms-with-durian-malware-kaspersky-confirms/" rel="">employed</a> a new malware variant dubbed “Durian” to targeted attacks on at least two cryptocurrency firms. Prior to that, a January <a href="https://crypto.news/kaspersky-warns-of-new-macos-malware-aiming-at-crypto-wallets/" rel="">report</a> from cybersecurity firm Kaspersky revealed that a malware was targetting cryptocurrency wallets on MacOS. 
 Read more: <a href="https://crypto.news/kraken-dutch-license-crypto-europe/" rel=""> Kraken obtains Dutch license, expands crypto services in Europe </a>

ESET and Dutch police expose Ebury botnet’s cryptocurrency theft operations

crypto.news

Other articles published on May 23, 2024

Glassnode Reports Slowing Demand for Bitcoin

DTX Presale Joins Market Uptrend; SUI And ONDO Investors Excited By Bullish Recovery

Transak Now Supports USDT on TON, Simplifying Fiat-to-Crypto Transactions

Demystifying Web3: Exploring How Decentralization Could Reshape the Future of the Internet

US House Passes FIT21 Crypto Bill As Coinbase Lauds Move Towards Clear Regulation

Coinbase Relists XRP for New York Residents After Nine-Month Hiatus

Join our free newsletter for daily crypto updates!