Threat video1:00
Injective SDK 1.20.21 Wallet Key Theft: Detection & IOCs
Attackers published a trojaned Injective SDK 1.20.21 that steals wallet keys; 9 detection rules, 9 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Injective SDK 1.20.21 Wallet Key Theft: Detection & IOCs →
Chapters
- 0:00The hookInjective SDK steals wallet keys.
- 0:04The storyCompromised account, SDK published.
- 0:10Attack pathPublished trojanized SDK hooked wallet functions.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise9 indicators to hunt: 2 domains, 1 URL and 3 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation4 steps now: Identify any project, lockfile, container image or CI cache.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Injective SDK steals wallet keys.
0:05Compromised account, SDK published.
0:08Wallet functions hooked, keys stolen.
0:11Published trojanized SDK hooked wallet functions.
0:14Pinned to dependent packages.
0:16Captured mnemonics and private keys.
0:19Encoded for transmission.
0:20Posted over HTTPS.
0:25No threat actor is attributed. Confidence: low.
0:309 indicators to hunt: 2 domains, 1 URL and 3 SHA-256 hashes, and more.
0:388 ATT&CK techniques, from initial access to command and control.
0:434 steps now: Identify any project, lockfile, container image or CI cache.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.