Threat video1:00
BTCPay Server Hot Wallet Drains: Detection & IOCs
Attackers gained admin on self-hosted BTCPay Server v2.4.1 and older, then swept hot wallets. 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for BTCPay Server Hot Wallet Drains: Detection & IOCs →
Chapters
- 0:00The hookVersion 2.4.1 and earlier: hot wallets drained.
- 0:05The storyVersion 2.4.1 and earlier: attackers logged in.
- 0:12Attack pathReportedly, attackers obtained administrator access on unpatched instances.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise5 indicators to hunt: 3 file names and 2 package names.
- 0:37MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to impact.
- 0:42Remediation5 steps now: Take any BTCPay Server instance running.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Version 2.4.1 and earlier: hot wallets drained.
0:05Version 2.4.1 and earlier: attackers logged in.
0:09They swept Bitcoin and Litecoin.
0:12Reportedly, attackers obtained administrator access on unpatched instances.
0:18They logged in and accessed the hot wallet credentials.
0:21Then swept Bitcoin and Litecoin.
0:27No threat actor is attributed. Confidence: low.
0:325 indicators to hunt: 3 file names and 2 package names.
0:384 ATT&CK techniques, from initial access to impact.
0:435 steps now: Take any BTCPay Server instance running.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.