Malwarehigh
Enigma info-stealing malware targets the cryptocurrency industry
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2291 | Input Validation DoS Flaw in Intel Ethernet Diagnostics Driver for Windows | 7.8 | 16% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.telegram.org | request to the attacker-controlled Telegram channel https://api[.]telegram[.]org/bot{token}/getFile to obtain the file_path. This approa |
| ipv4 | 193.56.146.29 | ds, and receiving the payload heartbeat. The second server (193[.]56[.]146[.]29) is used for DevOps and logging purposes. The malicio |
From the original article
2 min read at securityaffairs.com
Alleged Russian threat actors have been targeting cryptocurrency users in Eastern Europe with Enigma info-stealing malware. A malware campaign conducted by alleged Russian threat actors has been targeting users in Eastern European in the crypto industry. The attackers are sending out emails with fake job opportunities as bait in an attempt to trick victims into installing Enigma information-stealing malware.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.