Attacker Targets Wealthy Crypto Funds Using Telegram Chats

In the latest type of crypto-focused attacks, an attacker known as DEV-0139 has targeted wealthy cryptocurrency funds through the use of Telegram group chats, Microsoft's (MSFT) Security Intelligence team said in a report on Wednesday.

Fees levied by crypto exchanges on transactions are a big challenge for investment funds and wealthy traders. They represent a cost and must be optimized to minimize the impact on margins and profits. As is the case with many other companies in this industry, the largest costs come from fees charged by exchanges.

The attacker or group of attackers capitalized on this specific problem to lure their crypto-fund targets.

DEV-0139 joined several Telegram groups, used by high-profile clients and exchanges for communication, and identified their target from among the group members. OKX, Huobi and Binance exchanges were targeted, data from the Microsoft report shows.

Posing as an exchange employee, DEV-0139 invited the target to a different chat group and pretended to ask for feedback on the fee structures used by exchanges. They then initiated a conversation to gain the target’s trust – using their knowledge of the industry and preparedness to lure victims gradually.

DEV-0139 then sent a weaponized Excel file containing accurate data on fee structures among cryptocurrency-exchange companies with the goal of increasing his or her credibility.

The Excel file initiated a series of activities, including using a malicious program to retrieve data and drop another Excel sheet. This sheet was then executed in invisible mode and used to download a picture file containing three executables: a legitimate Windows file, a malicious version of a DLL file and an XOR-encoded back door.

A DLL is a library that contains code and data that can be used by more than one program at the same time. On the other hand, XOR is an encryption method used to encrypt data and is hard to crack by the brute-force method

The threat actor was then able to remotely access the infected system through the use of the back door.

Microsoft said DEV-0139 may have also run other campaigns using similar techniques.