Phantom X

Security Researcher | Explorer of the Digital Ether | Kimchi Says Hello 🧐. Focused on #Cybercrime #Phishing #APT #ThreatIntel #InfoSec

[Phantom X @PhantomXSec]

🚨 North Korean APT group responsible for crypto and NFT phishing campaign spanning over 190 domains

Targeting dozens of $ETH and $SOL projects.

Uses collections on NFT marketplaces to lure victims to malicious minting sites.

🧵1/

#Phishing #NFT #NorthKorea #cybercrime

[Phantom X @PhantomXSec]

All domains in this cluster point to wallet: 0x00000006dED0c4D8C7A82Ba04b5995A0b54E0A3E

Full list of domains:
https://t.co/2xc9kTpY7D

4/4

[Phantom X @PhantomXSec]

🚨Small cluster of 8 NFT drainer sites found on @Hetzner_Online 162.55.38[.]225, connected to larger campaign.

New Telegram notification TTPs discovered.

🧵1/

#Phishing #cybercrime #NFTs

[Phantom X @PhantomXSec]

🚨Huge campaign of 900+ Crypto and NFT drainer sites is now linked to this same threat actor.

Activity began in January and is still active. Targeting both $ETH and $SOL projects.

Full list of domains at the end of the 🧵

1/

#Phishing #NFT #Cybercrime

[Phantom X @PhantomXSec]

The second notification technique is newly discovered. Examples are from kanpaipandas[.]art.

Visitor actions on the domains are sent to a Telegram Bot in Russian.

There is a handy list of the actions/notifications in /javascript/import_main.js.

3/

[23pds (山哥) @im23pds]

⚠️ There are 728 phishing scam sites on this IP
Scam site:
Metascannft[.]xyz
@evilcos @PhantomXSec @SlowMist_Team @1c4m3by

[Phantom X @PhantomXSec]

@IM_23pds @namesilo @realScamSniffer Yeah, there are a ton of scam sites on that IP, I just pulled out the obviously associated ones. Would need more hours and a shower to go through the whole pool.

[Phantom X @PhantomXSec]

🚨Fifteen phishing domains tied to this massive campaign registered and hosted by @namesilo on 199.33.112[.]228.

Slight diversification in lures away from free minting to include the $ETH merge.

Full list at the end of the 🧵

1/

#Phishing #NFT #cybercrime

[Phantom X @PhantomXSec]

🚨Huge campaign of 900+ Crypto and NFT drainer sites is now linked to this same threat actor.

Activity began in January and is still active. Targeting both $ETH and $SOL projects.

Full list of domains at the end of the 🧵

1/

#Phishing #NFT #Cybercrime

[Phantom X @PhantomXSec]

Full list of Domains on 23.225.152[.]131:
https://t.co/EBSUE46BBQ

4/

[Phantom X @PhantomXSec]

Another 280 NFT drainer sites located on CloudRadium LLC IP 23.225.152[.]131 are associated with this campaign.

Still uses semi-unique TTP of subdomains versus standalone sites.

Discovered from code remnants on a domain on 199.33.112[.]228

🧵1/

#Phishing #NFT #Cybercrime

[Phantom X @PhantomXSec]

🚨Huge campaign of 900+ Crypto and NFT drainer sites is now linked to this same threat actor.

Activity began in January and is still active. Targeting both $ETH and $SOL projects.

Full list of domains at the end of the 🧵

1/

#Phishing #NFT #Cybercrime

[Phantom X @PhantomXSec]

Associated Wallets:
0x0AA7F992Dfb485Cf9c4FbE9688F1ECdf9e0A15f9
0xB2dA7748F16dBddEf7C1963000C35B49297a7d06

3/

[Phantom X @PhantomXSec]

Full list of Domains on 199.33.112[.]228:
https://t.co/BJXhd5v6yC

Full list of Domains on 23.225.152[.]131:
https://t.co/EBSUE46BBQ

6/

[Phantom X @PhantomXSec]

Associated Wallets:
0xd2089ff4E050A29e85fb5a447F83628E2a697555
0x5B68C0B4A259179aE792B91dF30f82521322e795
0x2AcFD0152bDBdD5AED36984D4897E08449A189D7

5/

[Phantom X @PhantomXSec]

Fake @opensea phishing domain 0pensea[.]biz registered and hosted by @namesilo on 199.33.112[.]228.

Harvests wallet private keys, keystore and recovery phrases.

Collected data is sent to kuchbhi[.]info/post.info

#Phishing #NFT #cybercrime

[Phantom X @PhantomXSec]

🚨Phishing domain getdoodles[.]top just went live on 45.12.2[.]67.

Semi-unique lure offering cheap floor @doodles.

Actor Wallet:
0xc68C8567991e2B5718ff999A70326EF483403bEe

#Phishing #NFT

[Phantom X @PhantomXSec]

🚨Cluster of at least 29 NFT drainer sites found on Virtual Systems LLC IP 45.12.2[.]67. All associated with same threat entity.

Targeting both $SOL and $ETH projects plus $CEEK.

Used Custom Name Servers.

🧵1/

#Phishing #NFT #cybercrime

[Phantom X @PhantomXSec]

@IM_23pds Will have to check the earlier campaign for overlaps but definitely dedicated hosting.

[Phantom X @PhantomXSec]

Please report this scam account.

Also, don't trust the obvious typo squatting site premint-mint[.]xyz

Wallet:
0xaC21Cb915E8A3fd8f465ed980C29B3c730dee67c

#Phishing #NFT

[Phantom X @PhantomXSec]

@IM_23pds Overwhelmingly sure it's part of the 900+ campaign based on code overlap. I scanned Rareapepeyc[.]top on urlscan while it's up.