Threat video1:00
Chainalysis Offensive Agentic Breach: Detection & IOCs
Chainalysis breach used offensive agentic techniques to expose customer emails and role labels. Includes 9 detection rules (one free in Splunk SPL) and 7 IOCs.
Read the full threat intel for Chainalysis Offensive Agentic Breach: Detection & IOCs →
Chapters
- 0:00The hookChainalysis breached by agentic techniques, exposing user data.
- 0:05The storyIn October, agentic techniques breached Chainalysis systems.
- 0:13Attack pathAccording to the vendor, offensive agentic techniques exploited internal system vulnerabilities.
- 0:31AttributionNo threat actor is attributed.
- 0:35Indicators of compromise2 indicators to hunt: 2 file names.
- 0:40MITRE ATT&CK techniques5 ATT&CK techniques, from reconnaissance to collection.
- 0:44Remediation4 steps now: Enable two-factor authentication on all Chainalysis user accounts.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Chainalysis breached by agentic techniques, exposing user data.
0:05In October, agentic techniques breached Chainalysis systems.
0:09Customer data exposed: emails, names, role labels.
0:14According to the vendor, offensive agentic techniques exploited internal system vulnerabilities.
0:20Attackers gained access to internal tools, harvesting customer account records.
0:25No evidence of credential theft, MFA tokens, or session data accessed.
0:32No threat actor is attributed. Confidence: low.
0:362 indicators to hunt: 2 file names.
0:415 ATT&CK techniques, from reconnaissance to collection.
0:454 steps now: Enable two-factor authentication on all Chainalysis user accounts.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.