Hello, World!
Putin is waging a war on Tor, and it’s created an opportunity for cyber criminals to steal
hundreds of thousands of dollars worth of crypto from Tor users.
The Russian government has been trading blows with the internet’s favourite anonymity
network for years, a while ago they even offered a 6 figure bounty to anyone who could crack
Tor - and whilst that obviously didn’t happen, the heat turned up in 2021, when Russia completely
blocked the Tor project’s website - on the basis it spread “tools that provide access
to unlawful content”.
Which, there might be some truth in...
Before the block, Russia was the second largest country using Tor with 300 thousand Russians
using it daily.
But after the ban, this plummeted by about 2 thirds.
And whilst the block was lifted last year - thanks to the Tor Project’s lawyers exploiting
a legal loophole, this only restored access to Tor’s website - the nodes underpinning
the network itself are still subject to Russian blockades, so the service is difficult for
Russians to use.
However, the Tor browser recently received an update which helps circumvent censorship
by auto connecting to a Tor bridge, but only about 40 thousand Russians have switched to
doing this, so Tor has a net loss of about 150 thousand users.
And this is where cyber criminals have spotted an opportunity.
Tempting these people to download hacked copies of Tor - and given many Tor users love a bit
of cheeky dark web shopping, cyber criminals are including clipper malware designed to
secretly scoop up crypto.
The campaign, which which was discovered by Kaspersky, starts with an innocent looking
torbrowser.exe.
Whilst it looks like - and is an executable, this is a self extracting executable in disguise,
as in it’s really just an archive bundled with the code needed to extract it.
So, upon running it, its contents are extracted, which does actually include a completely legit
copy of Tor.
But in the background, another archive - which is password protected, along with an extraction
tool are also extracted - after which the second archive is auto extracted into AppData.
Disguised as uTorrent, this is our payload - clipper malware which waits in the background
for the unfortunate victim to visit their favourite dark web marketplace.
When they copy a crypto wallet address to send coins to, the malware will match it with
one of it’s regular expressions in order to figure out what type of crypto it’s for,
then the clipboard will be replaced with one of the over 26 thousand hardcoded wallet addresses
- so you end up sending your coins to the bad actor’s wallet.
This clipper malware is really quite basic, more advanced variants will phone home to
a command and control server which will generate a wallet address in real time that shares
the last few characters of the genuine address, so if the victim checks the end of the address
just to make sure they copied it correctly, they’re not going to notice the difference.
The origins of clipper malware don’t actually lie in crypto.
It dates back to the prehistoric era of 2013, when researchers discovered “a new strain
of unusual malware” targeting “Polish online banking users”.
The malware, written in visual basic would monitor the clipboard for 26 digit bank account
numbers, replacing them with one of its own.
But fast forward to 2023 and this latest campaign targeting Tor users has proved rather successful,
with the miscreants behind it siphoning off almost 400 thousand dollars worth of crypto.
But of course, there’s no telling just how much Monero was nabbed, however thanks to
its dark web popularity it’d easily be second on this list.
One piece of the puzzle that the researchers just weren’t able to figure out was how
this malware is spreading, similar malware in the past has utilised fake Tor update pages.
Hosted on typo-squatted domains, links to these sites are be spammed on the dark web.
And whilst it might seem difficult to fall for something like this, people have fallen
for much simpler and way more nefarious campaigns.
A good example being from last year when a hacked version of Tor was being spread on
YouTube.
The video in question had 50k views, which might not seem like a lot, but for a video
that was essentially just a download link, is loads.
Chinese users were the target here, which is kinda strange, because YouTube is blocked
in China, so to be able to have even seen the video you had to be using a VPN - and
using a VPN would have enabled you to visit the legit tor website, rather than getting
your Tor from some random youtube video.
But anyway, rather than stealing crypto, the malware embedded in this Tor clone would pull
browsing history, social media account ids, and details of WiFi networks you’re connected
to - in other words everything that’s needed to unmask a Tor user’s real identity.
Whether this was done by cyber criminals who would blackmail victims, threatening to send
details of their devilish dark web dealings to the CCP, or if it was done by the CCP themselves,
we don’t know, but feel free to leave your theories in the comments.
This video is brought to you by PlexTrac, who’re offering you a FREE one month trial
of their premier cybersecurity reporting and collaboration platform.
Get started today to learn why the best offensive security teams trust PlexTrac.
PlexTrac empowers users to build better reports in half the time, exponentially increasing
ROI and time savings, To aggregate findings from all their tools by consolidating the
testing process into one platform, creating a single source of truth, and to maximize
their reusable report content, like findings writeups and narratives, improving consistency
across the team.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement.
Ready to elevate your reporting, improve collaboration across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always, thanks for watching and I’ll see you in the next video, have a good one.