Threat video1:00
Patrick Steven Yaroch FBI Crypto Theft: Detection & IOCs
An FBI supervisor abused his access to drain crypto wallets; 9 detection rules, 8 IOCs and 4 ATT&CK techniques, with a free Splunk SPL rule.
Read the full threat intel for Patrick Steven Yaroch FBI Crypto Theft: Detection & IOCs →
Chapters
- 0:00The hookFBI agent stole about $2.4 million in crypto.
- 0:04The storyUsing seniority, he read wallet codes.
- 0:10Attack pathHe reportedly used FBI system access to read wallet codes.
- 0:28AttributionAttributed to Patrick Steven Yaroch.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to impact.
- 0:43Remediation2 steps now: Audit access logs for systems that store wallet credentials, seed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00FBI agent stole about $2.4 million in crypto.
0:05Using seniority, he read wallet codes.
0:08Then moved millions to his accounts.
0:11He reportedly used FBI system access to read wallet codes.
0:15Over nineteen months, he transferred funds from 79 wallets.
0:20Victims included nation-states and crime victims alike.
0:23He confessed and pleaded guilty.
0:28Attributed to Patrick Steven Yaroch. Confidence: high.
0:33No malicious indicators were published.
0:394 ATT&CK techniques, from initial access to impact.
0:442 steps now: Audit access logs for systems that store wallet credentials, seed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.