Threat video1:00
BTCPay Server 2.4.1 LND Macaroon Theft: Detection & IOCs
Attackers steal LND macaroons from BTCPay Server 2.4.1 and earlier to take over Lightning nodes: 9 detection rules, 11 IOCs, a free Splunk SPL rule.
Read the full threat intel for BTCPay Server 2.4.1 LND Macaroon Theft: Detection & IOCs →
Chapters
- 0:00The hook2 waves of attacks drained hot wallets.
- 0:04The storyAn August patch was released.
- 0:11Attack pathReportedly found exposed servers, stole macaroons.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise6 indicators to hunt: 2 wallet addresss and 4 package names.
- 0:38MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to impact.
- 0:43Remediation6 steps now: Update to BTCPay Server.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:002 waves of attacks drained hot wallets.
0:05An August patch was released.
0:07November brought fresh attacks.
0:11Reportedly found exposed servers, stole macaroons.
0:15Authenticated as the LND node.
0:17Closed channels, swept Lightning funds.
0:20Different exploit accessed hot-wallet keys.
0:22Sent funds to attacker addresses.
0:28No threat actor is attributed. Confidence: low.
0:326 indicators to hunt: 2 wallet addresss and 4 package names.
0:386 ATT&CK techniques, from initial access to impact.
0:436 steps now: Update to BTCPay Server.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.