Ledger database hack facilitates spear-phishing attacks
An in depth analysis of the latest scams following the breach of the Ledger database
Background
Following the news of the latest hack targeting the Ledger database and the leak of millions of emails, phishing attacks have rapidly increased. The leaked data does not contain any financial information according to Ledger, but emails and personal information are already being used in targeted phishing campaigns, as we can see from the banner on their website.
Ledger has also started a counter-campaign to take down phishing websites called #StopTheSpammers. More details are available here:
The phishing attacks
We have been tracking the presence of Ledger leaked data online in the last few days and most of the published archives have been proactively removed, while some are still available for download as shown from the paste below dated Dec 20th, 2020 (links have been cropped).
Three days after the leak, we already detected many domains created to carry out phishing attacks, using different techniques including typo-squatted domains. We started actively investigating few of the many domains.
The phishing attacks that have been submitted to us starts with a text email that contains the following text (URLs have been sanitized)
Once the user clicks on the Google doc link, Google shows the classic redirect message, with the wrong text/address (ledger.com) as shown below:
but actually, the victim will be redirected to the actual phishing website:
The first screen invites the user to choose its Ledger Nano model
When the user selects the model, the website simulates the connection of the hardware device to the computer
and ask for the passphrase to unlock it, collecting some more details about the victim like in the screenshot below. We can see the mnemonic_phrase being asked as well.
After the victim fills in the sensitive information it is being sent in a POST request to the server where it is being saved. Using this information the attackers can continue their attack to potentially steal the coins.
The website had also some attention from other security researchers on Twitter, and Ledger confirmed the scam.
Looking at the WHOIS information, the domain was registered on the 15-12-2020 and edited on the 20th of the same month. The data below are collected from the Phoenix platform (see Conclusions)
The domains are currently hosted on popular cloud platforms such as Alibaba and Amazon cloud and the WHOIS information are privacy protected (hidden). Getting them would require a subpoena. :)
During our analysis, we identified a file containing some balances publicly available on the phishing website.
This information cannot be connected to legit accounts yet but helps us to further understand how the clone kit operates, giving insights on possible ways of recovering stolen credentials.
About the domain
Similar domains have been already used in the past to host phishing websites targeting different companies such as
Instagram
Snapchat
Google
Outlook
Apple
Twitter
Facebook
and many more.
where login-account.cfwas used with the following subdomains (now offline)
Attribution from code analysis
The phishing website is what we normally see in phishing websites. It misses a lot of functionality and is only focused on getting sensitive information out. The front end is HTML/CSS website and uses the jQuery JavaScript library. The back end is written in PHP with databases support and runs behind an Nginx reverse proxy that supports HTTP/2. The phishing website runs over TLS with a Let's Encrypt generated certificate.
Based on the comments (//прописываем куку) that are left in parts of the JavaScript on the website we can with some certainty conclude that it is built by a Russian speaking crew.
This claim is also supported by some of PHP file names that we have identified on the server, for example spisok.php which translates as 'list.php' in english.
Malware campaign
Another campaign is tricking users into downloading the Ledger desktop application for Win, Mac, or Linux. This campaign is heavily relying on typo squatted websites to distribute malware. The first screen looks exactly like the "Download" page of the original website
where the user can choose the OS for which the application will be downloaded. We compared the original desktop application against the malicious one and indeed the hash is different, due to new code added.
As soon as the app is launched, there is a call made to the C&C as we can see from the image below, but because the website is currently down at the moment of writing, the application returns an error, disclosing the endpoint
Code Analysis
The original Electron application has been repackaged to include JavaScript code that sends back information about the user and the newly chosen passphrase. As soon as the application is started, it tries to connect back to the C&C server using the following code
Once the connection has been established, and the C&C is up, the user is presented with fake Onboarding screens, where the 24 words used in the passphrase will be entered
and then collected using a POST request to {SERVER}/rss.php as shown below on line 13
The final mnemonic phrase is also collected using the following code
Contact us
If you received an email or an SMS redirecting to a phishing website, contact us and we will take immediate action to report the phishing website to the right authorities
In case you are a victim of the breach, please follow the recommendation provided by Ledger at
If you are not sure whether your email has been leaked, use the service provided by HaveIBeenPwned at
Improve your detection capabilities
Phoenix is our antiphishing tool that can proactively detect and report phishing attacks, combining different discovery techniques and automated reporting plugins. We constantly monitor all the new registered domains, typo-squatted domains, blacklists, deep web, forums, and more to provide insights on new attacks. Our light agent is capable of detecting clones even before they are online.
The detected websites are indeed phishing websites, trying to steal the backup phrase
Conclusions
Cryptocurrencies are one of the most valuable targets for phishers that are constantly trying to find different ways of bypassing security measures in place such as Multi-Factor Authentication (MFA). Many attacks are still ongoing and immediate action to take down the websites is needed. Continuous awareness, detection, and response can improve the impact of phishing attacks. Check how DCODX can help you detect stolen credentials and make phishing websites disappear in seconds using Phinix, putting you in control of the phishing website and being one step ahead of the phishers.
References
Last updated