Threat video1:00
TraderTraitor Binance Wallet Theft: Detection & IOCs
Fake recruiters delivered a poisoned assignment to Binance engineers. Includes 9 detection rules, 8 IOCs and 13 techniques, plus a free Splunk SPL rule.
Read the full threat intel for TraderTraitor Binance Wallet Theft: Detection & IOCs →
Chapters
- 0:00The hookNorth Korea stole about $6.3B from Binance.
- 0:05The storyTrojanned installer.
- 0:12Attack pathTrojanned installer, fake interview, poisoned tool.
- 0:28AttributionAttributed to TraderTraitor.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Rotate and decommission credentials and tokens of any engineer who.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00North Korea stole about $6.3B from Binance.
0:05Trojanned installer. Fake recruiter. AI tool pivot.
0:09Four stages, one month.
0:12Trojanned installer, fake interview, poisoned tool.
0:15Implant reached command and control.
0:17AI tool became the pivot.
0:19Wallet signing service compromised.
0:22EIP-7702 delegation persisted.
0:28Attributed to TraderTraitor. Confidence: high.
0:33No malicious indicators were published.
0:3813 ATT&CK techniques, from initial access to impact.
0:434 steps now: Rotate and decommission credentials and tokens of any engineer who.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.