Threat video1:00
LNbits Extension Exploit Drains Wallets: Detection & IOCs
Attackers drained 2,285,545 sats from a BitTipBot LNbits instance; no fixed release yet. Find it with 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for LNbits Extension Exploit Drains Wallets: Detection & IOCs →
Chapters
- 0:00The hookAttackers withdrew about 2,285,545 sats from BitTipBot.
- 0:08The storyAttackers created new accounts, then withdrew funds.
- 0:15Attack pathNext, new accounts appeared on the instance.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise3 indicators to hunt: 3 package names.
- 0:38MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to impact.
- 0:42Remediation4 steps now: Stop all LNbits servers immediately, as instructed by the LNbits.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Attackers withdrew about 2,285,545 sats from BitTipBot.
0:08Attackers created new accounts, then withdrew funds.
0:11LNbits told operators to stop servers.
0:16Next, new accounts appeared on the instance.
0:18Those accounts then withdrew funds.
0:21No CVE is published, and the extension is unnamed.
0:28No threat actor is attributed. Confidence: low.
0:323 indicators to hunt: 3 package names.
0:384 ATT&CK techniques, from initial access to impact.
0:434 steps now: Stop all LNbits servers immediately, as instructed by the LNbits.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.