Threat video1:00
Chainalysis AitM Live-Token Breach: Detection & IOCs
An on-path attack in Chainalysis's breach exposed customer passwords and live tokens. Covered by 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Chainalysis AitM Live-Token Breach: Detection & IOCs →
Chapters
- 0:00The hookAgentic attack: Chainalysis credentials and tokens exposed.
- 0:05The storyChainalysis detected aggressive agentic attack techniques.
- 0:13Attack pathAgentic tools gained unauthorized access to internal systems.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from resource development to collection.
- 0:43Remediation5 steps now: Force password resets for all Chainalysis platform users before restoring.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Agentic attack: Chainalysis credentials and tokens exposed.
0:05Chainalysis detected aggressive agentic attack techniques.
0:09Credentials and live tokens were stolen.
0:13Agentic tools gained unauthorized access to internal systems.
0:18On-path attack intercepted login credentials and live tokens.
0:22Services taken offline, users forced to reset credentials.
0:29No threat actor is attributed. Confidence: low.
0:33No malicious indicators were published.
0:395 ATT&CK techniques, from resource development to collection.
0:435 steps now: Force password resets for all Chainalysis platform users before restoring.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.