Hello, World!
AlphaBay is about to become the number one dark web market, again.
Founded in 2014, Alphabay established itself as the most successful dark web market of
all time - it was 10 times larger than the legendary silk road and had 400 thousand active
users, facilitating a million dollars in sales per day.
But in 2017 it was raided and shutdown in what came to be known as "operation bayonet".
Now, usually when a dark net market gets raided, that's it, gone forever, relegated to nothing
more than a Wikipedia page, at best, most of them don't even end up with one.
But last year something strange happened, AlphaBay mysteriously reappeared.
At first people were a bit confused because Alphabay's owner "Alpha02", otherwise known
as "Alexandre Cazes" killed himself while in jail - some people say he was Epsteined,
but there's no questionable circumstances surrounding his death like there is with the
actual Jeffrey Epstein case.
But either way, the new site wasn't being run by "alpha02" from beyond the grave - but
rather the site's operator claims he was the original Alphabay's second in command, who
goes by 'DeSnake' - he attempted to prove his identity by verifying he was in the possession
of PGP keys used by the original alphabay.
However, many people weren't convinced by this proof, and it was kinda just assumed
that either the FBI had somehow seized DeSnake's PGP keys and decided to reboot AlphaBay as
a honeypot, or that the keys had somehow fallen into the hands of scammers just looking to
hijack the Alphabay brand to pull an exit scam.
But whether or not the site is run by who it claims, fast forward less than a year and
enough people have trusted AlphaBay to put it on track to regaining it's crown as the
most popular dark web market.
The site now has 30 thousand product listings, which is topped only by a market called "ASAP"
with 50 thousand.
But AlphaBay is growing much faster.
This chart from flashpoint shows the number of new products listed on different dark web
markets per day, and whilst the rebooted AlphaBay only really made it onto the radar 6 months
ago, at present it's the second most popular market measured by total number of product
listings.
One of the main reasons for AlphaBay's resurgence is the recent downfall of numerous other darkweb
markets.
For example "dark0de reborn" and "world market" both pulled exit scams, in that they randomly
disappeared with their user's crypto.
And the Versus market closed down after they had a severe security vulnerability exposed.
But despite AlphaBay inching towards the number one spot, yet again, there's still a lot of
distrust as to whether it's some kind of FBI honeypot.
I reckon it's really unlikely though, simply because there isn't much for authorities to
gain here.
For example, the site encourages you to PGP encrypt all seller/buyer communications, which
would make it impossible for whoever is running the market to read messages.
And on top of that, AlphaBay exclusively uses Monero - which makes tracing payments impossible
because Monero doesn't have a transparent blockchain like bitcoin does.
So if this new AlphaBay is a honeypot, it's a pretty bad one because there really isn't
much to gain in terms of information on the users.
But this of course has no bearing on whether AlphaBay is run by scammers looking to pull
an exit scam.
An analysis of a couple dozen dark web marketplaces, shows that exit scams are typically pulled
within the first 18 months of a marketplace's existence, and that if a market lasts 2 years,
chances are it's operators aren't looking to pull an exit scam, though it could still
be raided by authorities of course, either way the users lose their coins.
Next up, there are some developments in the story of the largest crypto heist of all time.
So, back in March over $600 million dollars mainly in Ethereum was stolen from Axie Infinity,
a play to earn NFT game.
Idea being as you play the game you earn tokens, which can then be sold for real money.
I've personally never played Axie, it's just not my thing, I also have no idea how the
game mechanics work, but nevertheless here's some random gameplay of it.
At the height of the recent crypto boom, cycle, bubble, whatever you want to call it, the
hype for the Axie Infinity and the demand for in game tokens was so great that people
in certain parts of the world were able to make a living, literally just from playing
this game for a few hours a day.
But, this hype also attracted the attention of...
North Korean government backed hackers, and on the 29th of March, "Ronin" the network
which underpins the game, was hacked, resulting in the largest crypto heist ever.
At the time I initially covered the hack, details were scarce.
But thanks to a recent leak we now have the juicy details about how an employee was socially
engineered into providing hackers access to the network.
It all began when a senior engineer working on the network was approached on LinkedIn,
he was given the opportunity to apply for a job - a very well paying job.
But unbeknownst to him, the job and the company he thought he was talking to didn't exist,
instead it was all a ruse, just to gain his trust.
After going through a couple of interviews the senior engineer was sent a job offer over
email - and this is where the screwup happened, the job offer came in the form of a PDF file.
"Which the engineer downloaded — allowing spyware to infiltrate Ronin’s systems."
Exactly how that PDF file installed spyware, we don't know for sure - the technical details
aren't being disclosed.
But in the past North Korean government hackers have been known to send malicious PDF viewing
software along with their PDF - so this may have been what happened here, rather than
the PDF itself being somehow malicious.
But however the hack occurred, the employee was a senior engineer, so I would assume and
kind of hope the hack was initiated by something a bit more sophisticated than joboffer.pdf.exe.
But either way, after gaining access to the engineer's computer, the North Korean infiltrators
eventually managed to compromise 5 of the 9 validator nodes which underpin the Ronin
network - more than half, meaning they were able to sign deposits and withdrawals - but
of course they were only interested in making that withdrawal of $625 million dollars comprised
of Ethereum and USD coin.
North Korean government backed hackers setting up fake companies, using job offers as bait
isn't new at all.
In fact, they've been using this trick for a good couple of years, stealing coins from
crypto companies in order to fund Kim's nuclear weapons ambitions - at least, according to
the UN.
And lastly, I'm a bit late on this one, but I figured it's amusing enough to make it worth
covering.
Last week the British Army's YouTube and Twitter accounts were taken over by miscreants who
used them to promote crypto scams.
The Army's Twitter account was rebranded to make it emulate a popular NFT collection,
promoting a typosquatted link - which redirects to a phishing page prompting people to connect
their crypto wallet to get one of these NFT gifs for free.
I'm relying on the wayback machine for this, since the original website has vanished, so
the button on the page just doesn't do anything, but I imagine the site asked people to enter
their wallet's recovery code so all of their crypto could be stolen.
The YouTube account however was turned into one of those standard Elon Musk scam pages
- whereby Elon Musk himself will double whatever bitcoin you send to his personal address.
We don't have any details on how the accounts were compromised, and the Ministry of defence
tweeted "The Army takes information security extremely seriously and until their investigation
is complete it would be inappropriate to comment further."
- which basically means we'll probably never hear anything on this topic ever again.
Nevertheless it's obviously pretty embarrassing - and the fact that both accounts were repurposed
at the same time suggests an MoD email account was compromised, that and 2 factor authentication
wasn't being used.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, sources can of course be found in the description.
Stay tuned for more hacking videos, and have a good one.