Jewelbug UAT-8302 APT: Dual-Mandate Espionage and Cryptocurrency Theft
Jewelbug (UAT-8302), a China-linked threat actor, is conducting hybrid espionage and cryptocurrency theft operations against Russian technology and IT sectors. The actor utilizes a bifurcated Command and Control (C2) architecture to separate stealthy intelligence exfiltration from high-volume financial operations. Initial access is achieved via direct exploitation and suspected software supply chain compromises. The malware arsenal consists of specialized info-stealers engineered for cryptocurrency seed phrase harvesting and custom backdoors designed for long-term persistence within critical infrastructure. This dual-mandate approach allows for the simultaneous theft of proprietary R&D data and decentralized assets, utilizing the noise of cybercrime to mask strategic intelligence gathering.
Critical Entropy Degradation in Coldcard Firmware Facilitates $38M BTC Theft
A critical firmware vulnerability in specific Coldcard Mk3 hardware wallet models has resulted in a catastrophic reduction of entropy during the seed generation process. The flaw, identified as a weak Pseudo-Random Number Generator (PRNG), degraded the cryptographic search space from a standard 128 bits to a highly vulnerable 40 bits. An attacker utilized AI-driven vulnerability discovery to identify the flaw and subsequently performed a rapid brute-force derivation of private keys. This coordinated attack resulted in the theft of approximately 594 BTC ($38 million) from up to 1,196 addresses within a 25-minute window, highlighting critical failures in automated security auditing and hardware-based entropy implementations.
Indirect Prompt Injection IPI in AI Agents Facilitating Unauthorized Cryptocurrency Transfers
Autonomous AI agents are increasingly susceptible to Indirect Prompt Injection (IPI), where malicious instructions are embedded within untrusted data sources such as web pages or documents. Attackers utilize encoded payloads (e.g., Base64) to bypass semantic filters, hijacking the agent's action layer to trigger unauthorized tool-calling and API execution. This vulnerability, confirmed across 13 frontier LLM models, enables the automated execution of irreversible cryptocurrency transactions. The primary risk lies in the agent's inability to distinguish between legitimate user intent and malicious instructions retrieved via Retrieval-Augmented Generation (RAG) pipelines.