CyberSecurity news
FlagThis - #crypto
|
Nicholas Kitonyi@NFTgators
//
References:
aboutdfir.com
, Metacurity
,
Nobitex, Iran's largest cryptocurrency exchange, has been targeted in a politically motivated cyberattack allegedly perpetrated by pro-Israel hackers. The attackers successfully drained over $90 million in cryptocurrency from the platform's wallets, subsequently rendering the assets inaccessible. Blockchain analytics firm Elliptic confirmed the theft, noting that the funds were deliberately destroyed rather than laundered, suggesting the primary intent was disruption and sending a political message linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The incident is part of an escalating conflict between Israel and Iran in cyberspace, with attacks targeting financial systems and media outlets.
The attack on Nobitex is a component of a broader campaign of cyber warfare between the two nations. In addition to the cryptocurrency theft, Bank Sepah, a major Iranian bank, also suffered significant outages as a result of the actions of pro-Israel hacktivist group Predatory Sparrow, who claimed responsibility for both attacks. The group stated that they deleted data, exfiltrated internal documents, and destroyed backups at Bank Sepah to maximize disruption. This follows previous cyber incidents between the two nations, raising concerns about potential escalations and retaliatory measures. The severity of the cyberattacks prompted the Iranian government to severely restrict internet access across the country, with connectivity plummeting by over 97%. This action, typically reserved for periods of civil unrest or elections, aimed to hinder further cyber intrusions and potentially control the flow of information. Meanwhile, U.S. cybersecurity groups are issuing advisories, warning of potential retaliatory attacks by Iranian-affiliated actors targeting American companies in sectors such as energy, finance, healthcare, and logistics. This cyber conflict between Israel and Iran is being viewed as a watershed moment, highlighting the growing intersection of geopolitics and cybersecurity with potential global implications. Recommended read:
References :
Nicholas Kitonyi@NFTgators
//
A pro-Israel hacking group, known as Predatory Sparrow, has claimed responsibility for a cyberattack against Nobitex, Iran’s largest cryptocurrency exchange. The attack resulted in the theft of approximately $90 million in various cryptocurrencies, including Bitcoin and Dogecoin, as well as over 100 other cryptocurrencies. According to blockchain analytics firm Elliptic, the funds were drained from the exchange’s wallets into blockchain addresses containing anti-government messages explicitly referencing Iran's Islamic Revolutionary Guard Corps (IRGC).
The attackers, instead of attempting to profit financially, intentionally destroyed the stolen cryptocurrency in what has been described as a symbolic political statement. The funds were sent to blockchain addresses with the phrase "F***iRGCTerrorists" embedded within them. Experts say that generating addresses with such specific terms requires significant computing power, suggesting the primary goal was to send a message rather than to gain financially. The incident underscores the rising geopolitical tensions between Israel and Iran and the vulnerability of cryptocurrency exchanges to politically motivated cyberattacks. The cyberattack on Nobitex is part of a broader pattern of cyber warfare between Israel and Iran. While the physical conflict has seen airstrikes and other military actions, the digital realm has become another battleground, with potentially significant repercussions for both countries and the wider global community. This incident also follows reports of internet restrictions within Iran, limiting citizens' access to information and communication amidst escalating tensions. The global cybersecurity community needs to stay prepared for security repercussions for the two combatants and the wider global community as the cyberwarfare portion of the conflict is already spilling over off the battlefield and outside the region. Recommended read:
References :
Ben Weiss@fortune.com
//
A pro-Israel hacktivist group known as Predatory Sparrow has claimed responsibility for a cyberattack on Nobitex, Iran's largest cryptocurrency exchange. The attack resulted in the theft and destruction of approximately $90 million in cryptocurrency. The group stated that Nobitex was targeted for allegedly financing terrorism and evading international sanctions for the Iranian regime. This incident highlights the increasing cyber conflict between Israel and Iran, with hacktivist groups playing a significant role in disruptive operations.
The hackers reportedly sent the stolen funds to inaccessible blockchain addresses, effectively "burning" the cryptocurrency and taking it out of circulation. Blockchain analysis firm Elliptic confirmed the transfer of over $90 million to multiple vanity addresses containing variations of "F--kIRGCterrorists" within their public key. This symbolic act suggests the intention was to send a political message rather than financial gain. It has been noted that Nobitex has over 10 million customers, raising concerns about the potential impact of the breach. The attack on Nobitex follows a recent claim by Predatory Sparrow of hacking Bank Sepah, another major Iranian financial institution. These cyberattacks come amid escalating tensions and exchanges of airstrikes between Israel and Iran. Cybersecurity experts warn of a growing digital conflict unfolding behind the scenes, with the potential for broader spillover effects. The situation emphasizes the vulnerability of cryptocurrency exchanges to sophisticated cyberattacks and the need for enhanced cybersecurity measures. Recommended read:
References :
Dissent@DataBreaches.Net
//
Coinbase confirmed a significant data breach affecting 69,461 customers, revealing that overseas support staff were bribed to hand over sensitive user data to criminals. The breach, which began on December 26, 2024, went undetected until May 11, 2025, leaving customers vulnerable to potential phishing attacks and extortion schemes. Coinbase acknowledged the incident in a filing with the Securities and Exchange Commission (SEC) on May 15, further detailing that the perpetrators attempted to extort the company for $20 million. The company has since confirmed the support staff involved have been fired.
The compromised data included a wide range of personal information, such as names, addresses, phone numbers, email addresses, the last four digits of Social Security numbers, masked bank account numbers, images of government IDs (passports and driver's licenses), and Coinbase account data, including balance snapshots and transaction histories. Coinbase emphasized that passwords, seed phrases, and private keys were not compromised, ensuring direct access to accounts and funds remained secure. The company is offering affected users free one-year credit monitoring and identity protection services to mitigate the potential fallout. In response to the breach, Coinbase is bolstering its cybersecurity measures and has issued a $20 million bounty for information leading to the arrest of those responsible. The company estimates spending between $180 million and $400 million to cover reimbursements to affected users and enhance security infrastructure. While Coinbase intends to reimburse customers who may have fallen victim to phishing scams stemming from the stolen data, concerns remain regarding the potential for continued targeting of Coinbase customers, prompting some legal professionals to consider class-action lawsuits against the cryptocurrency exchange. Recommended read:
References :
Dissent@DataBreaches.Net
//
Coinbase recently disclosed a significant data breach resulting from a bribery scheme targeting overseas customer support agents. The breach, which came to light after a $20 million ransom demand, involved rogue contractors who abused their access to exfiltrate customer data. Coinbase has confirmed that these contractors, located outside the United States, were successfully bribed by cybercriminals to access internal systems and steal sensitive information. Upon discovering the unauthorized activity, Coinbase terminated the involved personnel and initiated a thorough internal investigation.
The compromised data, affecting less than 1% of Coinbase's monthly transacting users, includes names, addresses, phone numbers, email addresses, and the last four digits of Social Security numbers. Additionally, masked bank account numbers, some banking identifiers, government-issued ID images such as driver's licenses and passports, and account data including balance snapshots and transaction histories were exposed. Importantly, Coinbase has stated that no passwords, private keys, or access to customer funds were compromised, and Coinbase Prime accounts and wallets were unaffected. In response to the breach, Coinbase refused to pay the $20 million ransom and instead offered a $20 million reward for information leading to the identification and prosecution of those responsible. The company is also reimbursing customers who mistakenly sent funds to the scammers due to phishing attempts. Furthermore, Coinbase is taking several steps to enhance security, including stricter identity verification, scam-awareness prompts, relocating support functions to a U.S.-based hub, and improving fraud monitoring and insider threat detection capabilities. This incident could potentially cost Coinbase between $180 million and $400 million for remediation and customer reimbursement. Recommended read:
References :
@www.silentpush.com
//
References:
gbhackers.com
, iHLS
,
North Korean operatives have infiltrated hundreds of Fortune 500 companies, posing a significant threat to IT infrastructure and sensitive data. Security experts revealed at the RSAC 2025 Conference that the infiltration extends across virtually every major corporation, with many Fortune 500 companies unknowingly employing North Korean technical workers. This alarming trend raises serious concerns about potential security breaches and data theft. The experts said that dozens of experts and law enforcement at RSA said the campaign is now out of control, impacting thousands of companies.
Even tech giant Google has detected North Korean technical workers in their talent pipeline as job candidates and applicants, although they have not been hired to date. "If you're not seeing this, it's because you're not detecting it, not because it's not happening to you," warned Iain Mulholland, senior director of security engineering at Google Cloud, emphasizing the universality of the threat. Insider risk management firm DTEX corroborated these findings, reporting that 7% of its customer base-representing a cross-section of the Fortune 2000-has been infiltrated by North Korean operatives working as full-time employees with privileged access. The North Korean IT worker scam has expanded beyond the tech and crypto industries and is now a threat to all companies. One cybersecurity expert even found evidence that a U.S. political campaign in Oregon hired a North Korean IT worker to build its website. Initially, the workers primarily focused on legitimate employment to generate funds for the regime in Pyongyang, but experts are now seeing a tactical shift toward extortion, which has been observed. Recommended read:
References :
@unit42.paloaltonetworks.com
//
North Korean state-sponsored group Slow Pisces, also known as Jade Sleet, TraderTraitor, and PUKCHONG, is actively targeting cryptocurrency developers through social engineering campaigns on LinkedIn. Security researchers at Palo Alto Networks have uncovered a scheme where the group poses as potential employers, enticing developers with coding challenges that are actually malware delivery mechanisms. The malicious activity is suspected to be connected to the massive Bybit hack that occurred in February 2025.
The attackers send what appear to be legitimate coding assignments to the developers, but these challenges contain malware disguised within compromised projects. When the developers run these projects, their systems become infected with new customized Python malware dubbed RN Loader and RN Stealer. RN Loader collects basic information about the victim's machine and operating system, sending it to a remote server, while RN Stealer is designed to harvest sensitive data from infected Apple macOS systems, including system metadata and installed applications. GitHub and LinkedIn have taken action to remove the malicious accounts used by Slow Pisces. Both companies affirm that they use automated technology, expert teams, and user reporting to combat malicious actors. Palo Alto Networks customers are protected through their Next-Generation Firewall with Advanced URL Filtering and Advanced DNS Security subscriptions. They urge those who suspect they might be compromised to contact the Unit 42 Incident Response team. Recommended read:
References :
|