Microsoft warns that a threat actor tracked as Storm-0501 has evolved its operations, shifting away from encrypting devices with ransomware to focusing on cloud-based encryption, data theft, and extortion.

The hackers now abuse native cloud features to exfiltrate data, wipe backups, and destroy storage accounts, thereby applying pressure and extorting victims without deploying traditional ransomware encryption tools.

Storm-0501 is a threat actor who has been active since at least 2021, deploying the Sabbath ransomware in attacks against organizations worldwide. Over time, the threat actor joined various ransomware-as-a-service (RaaS) platforms, where they used encryptors from Hive, BlackCat (ALPHV), Hunters International, LockBit, and, more recently, Embargo ransomware.

In September 2024, Microsoft detailed how Storm-0501 extended its operations into hybrid cloud environments, pivoting from compromising Active Directory to Entra ID tenants. During these attacks, the threat actors either created persistent backdoors through malicious federated domains or encrypted on-premises devices using ransomware, such as Embargo.

A new report by Microsoft today outlines a shift in tactics, with Storm-0501 no longer relying on on-premises encryption and instead conducting attacks purely in the cloud.

“Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, cloud-based ransomware introduces a fundamental shift,” reads the report by Microsoft Threat Intelligence.

“Leveraging cloud-native capabilities, Storm-0501 rapidly exfiltrates large volumes of data, destroys data and backups within the victim environment, and demands ransom—all without relying on traditional malware deployment.”

Cloud-based ransomware attacks

In recent attacks observed by Microsoft, the hackers compromised multiple Active Directory domains and Entra tenants by exploiting gaps in Microsoft Defender deployments.

Storm-0501 then used stolen Directory Synchronization Accounts (DSAs) to enumerate users, roles, and Azure resources with tools such as AzureHound. The attackers eventually discovered a Global Administrator account that lacked multifactor authentication, allowing them to reset its password and gain complete administrative control.

With these privileges, they established persistence by adding malicious federated domains under their control, enabling them to impersonate almost any user and bypass MFA protections in the domain.

Microsoft says they escalated their access further into Azure by abusing the Microsoft.Authorization/elevateAccess/action, which allowed them to ultimately assign themselves to Owner roles, effectively taking over the victim’s entire Azure environment.

Once in control of the cloud environment, Storm-0501 began disabling defenses and stealing sensitive data from Azure Storage accounts. The threat actors also attempted to destroy storage snapshots, restore points, Recovery Services vaults, and storage accounts to prevent the target from recovering data for free.

When the threat actor couldn’t delete data from recovery services, they utilized cloud-based encryption by creating new Key Vaults and customer-managed keys, effectively encrypting the data with new keys and making it inaccessible to the company unless they pay a ransom.

After stealing data, destroying backups, or encrypting cloud data, Storm-0501 moved to the extortion phase, contacting victims through Microsoft Teams using compromised accounts to deliver ransom demands.

Microsoft’s report shares protection advice, Microsoft Defender XDR detections, and hunting queries that can help find and detect the tactics used by this threat actor.

As ransomware encryptors are increasingly blocked before they can encrypt devices, we may see other threat actors shift away from on-premise encryption to cloud-based data theft and encryption, which may be harder to detect and block.

The Pakistani APT36 cyberspies are using Linux .desktop files to load malware in new attacks against government and defense entities in India.

The activity, documented in reports by CYFIRMA and CloudSEK, aims at data exfiltration and persistent espionage access. APT 36 has previously used .desktop files to load malware in targeted espionage operations in South Asia.

The attacks were first spotted on August 1, 2025, and based on the latest evidence, are still ongoing.

Desktop file abuse

Although the attacks described in the two reports use different infrastructure and samples (based on hashes), the techniques, tactics and procedures (TTPs), attack chains, and apparent goals are the same.

Victims receive ZIP archives through phishing emails containing a malicious .desktop file disguised as a PDF document, and named accordingly.

Linux .desktop files are text-based application launchers that contain configuration options dictating how the desktop environment should display and run an application.

Users open the .desktop file thinking it’s a PDF, which causes a bash command hidden in the ‘Exec=” field to create a temporary filename in “/tmp/’ where it writes a hex-encoded payload fetched from the attacker’s server or Google Drive.

Then, it runs ‘chmod +x’ to make it executable and launches it in the background.

To lower suspicion for the victim, the script also launches Firefox to display a benign decoy PDF file hosted on Google Drive.

In addition to the manipulation of the ‘Exec=” field to run a sequence of shell commands, the attackers also added fields like “Terminal=false’ to hide the terminal window from the user, and ‘X-GNOME-Autostart-enabled=true’ to run the file at every login.

Typically, .desktop files on Linux are plain-text shortcut files, defining an icon, name, and command to execute when the user clicks it.

However, in APT36 attacks, the attackers abuse this launcher mechanism to turn it essentially into a malware dropper and persistence establishment system, similarly to how the ‘LNK’ shortcuts are abused on Windows.

Because .desktop files on Linux are typically text, not binaries, and as their abuse isn’t widely documented, security tools on the platform are unlikely to monitor them as potential threats.

The payload dropped by the malformed .desktop file in this case is a Go-based ELF executable that performs espionage functions.

Although packing and obfuscation made analysis challenging, the researchers found that it can be set to stay hidden, or attempt to set up its separate persistence using cron jobs and systemd services.

Communication with the C2 is made through a bi-directional WebSocket channel, allowing data exfiltration and remote command execution.

Both cybersecurity firms find this latest campaign to be a sign of the evolution of APT36’s tactics, which are turning more evasive and sophisticated.

A massive spike in brute-force attacks targeted Fortinet SSL VPNs earlier this month, followed by a switch to FortiManager, marked a deliberate shift in targeting that has historically preceded new vulnerability disclosures.

The campaign, detected by threat monitoring platform GreyNoise, manifested in two waves, on August 3 and August 5, with the second wave pivoting to FortiManager targeting with a different TCP signature.

As GreyNoise previously reported, such spikes in deliberate scanning and brute-forcing precede the disclosure of new security vulnerabilities 80% of the time.

Often, such scans aim at enumerating exposed endpoints, evaluating their significance, and estimating their exploitation potential, with actual attack waves following shortly after.

“New research shows spikes like this often precede the disclosure of new vulnerabilities affecting the same vendor — most within six weeks,” warned GreyNoise.

“In fact, GreyNoise found that spikes in activity triggering this exact tag are significantly correlated with future disclosed vulnerabilities in Fortinet products.”

Due to this, defenders shouldn’t dismiss those spikes in activity as failed attempts to exploit old, patched flaws, but rather treat them as potential precursors to zero-day disclosure and strengthen security measures to block them.

The Fortinet brute-force attacks

On August 3, 2025, GreyNoise recorded a spike in brute-forcing attempts targeting Fortinet SSL VPN as part of a steady activity it has been monitoring since earlier.

JA4+ fingerprint analysis, a network fingerprinting method for identifying and classifying encrypted traffic, linked the spike to June activity originating from a FortiGate device on a residential IP address associated with Pilot Fiber Inc.

“This overlap doesn’t confirm attribution, but it suggests possible reuse of tooling or network environments,” commented GreyNoise in its bulletin.

Two days later, on August 5, a new brute-force campaign from the same attacker emerged, which switched targeting from FortiOS SSL VPN endpoints to FortiManager’s FGFM service.

“While the August 3 traffic has targeted the FortiOS profile, traffic fingerprinted with TCP and client signatures — a meta signature — from August 5 onward was not hitting FortiOS,” explained GreyNoise.

“Instead, it was consistently targeting our FortiManager – FGFM profile albeit still triggering our Fortinet SSL VPN Bruteforcer tag.”

This shift suggested that either the same attackers or the same toolset/infrastructure moved from trying to brute-force VPN logins to trying to brute-force FortiManager access.

The IP addresses associated with this activity, and which should be placed on blocklists, are:

• 31.206.51.194
• 23.120.100.230
• 96.67.212.83
• 104.129.137.162
• 118.97.151.34
• 180.254.147.16
• 20.207.197.237
• 180.254.155.227
• 185.77.225.174
• 45.227.254.113

GreyNoise notes that the tracked malicious activity is evolving with time and is associated with a specific origin cluster that most likely performs adaptive testing.

In general, this activity is unlikely to be researcher scans, which are typically broader in scope and limited in rate, and wouldn’t involve credential brute-forcing, which is seen as an apparent intrusion attempt.

Hence, defenders should block the listed IPs, increase login protection on Fortinet devices, and harden external access where possible, restricting access only to trusted IP ranges and VPNs.

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure

A rise in violent crimes aimed at Bitcoin owners is drawing fresh alarm from security experts and industry groups.

According to speakers at the Baltic Honeybadger 2025 conference in Riga, Latvia, criminals are increasingly using stolen personal data plus on-chain analysis to find and attack people who hold Bitcoin and other digital assets.

The attacks—often called “wrench attacks”—can include kidnapping, physical assault, and extortion to force victims to hand over private keys.

Every week, at least one Bitcoin holder is reportedly kidnapped, tortured, extorted, or worse, say conference sources.

Data Leaks Fuel Criminal Targeting

According to Alena Vranova, founder of hardware wallet maker SatoshiLabs, more than 80 million crypto user identities are exposed online, and roughly 2.2 million of those records include home addresses.

Based on reports from Chainalysis, the number of wrench attacks in 2025 has already nearly matched the worst year on record and could double by year-end if trends continue.

US exchange Coinbase confirmed in May 2025 that some customers’ names and addresses were exposed in a hack, and Cybernews reported databases containing over 16 billion stolen credentials from large tech firms such as Apple, Facebook, and Google.

Criminals Are Working Faster And Smarter

Reports have disclosed that attackers combine leaked KYC data with blockchain analysis tools to spot high-value targets. Once a potential victim is identified, criminals may launch phishing campaigns, carry out SIM-swap attacks, or escalate to physical violence to obtain private keys.

Cases cited at the conference include kidnappings over amounts as small as $6,000 in crypto, and murders linked to roughly $50,000, undercutting the assumption that only the richest holders are at risk.

As more people enter the market during the bull run, organizers warn that less experienced investors can become easy marks.

Security Measures Move From Digital To Physical

Based on industry response, many high-profile holders are boosting physical security, hiring private guards, and taking steps to obscure their public crypto profiles.

Everyday investors are also being urged to adopt better operational security: use non-custodial wallets, enable multi-factor authentication that does not rely on SMS, use unique passwords and password managers, split holdings across multiple secure locations, and avoid talking publicly about the size of one’s holdings.

Experts stress that no single step is foolproof; a layered approach that separates key material and limits the amount any one person can access is recommended.

Featured image from Unsplash, chart from TradingView

Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.

Summer 2025 wasn’t just hot; it was relentless.

Ransomware hammered hospitals, retail giants suffered data breaches, insurance firms were hit by phishing, and nation-state actors launched disruptive campaigns.

From stealthy PowerShell loaders to zero-day SharePoint exploits, attackers kept defenders on their heels.

This report breaks down the season’s most high-impact incidents and what security teams need to do before the next wave hits.

Summer Expose Healthcare’s Growing Ransomware Risk

Hospitals can’t afford downtime, and attackers know it. 

This summer, ransomware groups targeted healthcare, exploiting both the value of patient data and the urgency of care.

Interlock rises as a major threat to US healthcare

A July 22, 2025, joint advisory by CISA, FBI, and HHS highlighted Interlock as a major threat to the Healthcare and Public Health (HPH) sector. The group is linked to around 14 incidents in 2025 alone, with a third affecting only healthcare providers.

What sets Interlock apart is its use of “FileFix,” a PowerShell launcher that hides malicious scripts behind decoy file paths. It tricks users into running payloads through File Explorer, bypassing typical security detections.

Rhysida ransomware targeted another US healthcare center

On July 8, 2025, the Rhysida ransomware group allegedly leaked sensitive data from Florida Hand Center, including medical images, driver’s licenses, and insurance forms. 

The clinic, which serves patients in Punta Gorda, Port Charlotte, and Fort Myers, was given just seven days to respond before the release.

Qilin recycles Scattered Spider playbook in wave of healthcare breaches

In June 2025, Qilin became the most active ransomware group, recording 81 victims, 52 of them in the healthcare sector.

The group exploited unpatched Fortinet vulnerabilities (CVE-2024-21762 and CVE-2024-55591) to gain access, deploy ransomware, and exfiltrate sensitive data such as EHRs and insurance records.

To maximize pressure, Qilin went beyond encryption, leveraging legal-themed extortion tactics like a “Call Lawyer” feature and automated negotiation tools to drive faster payouts.

Major Brands Breached in Retail Cybercrime Wave

The retail sector couldn’t escape the wave of cyberattacks sweeping through Summer 2025.

Louis Vuitton breach marks third in a quarter

On July 2, 2025, Louis Vuitton UK suffered a data breach exposing customer contact info and purchase history, its third LVMH brand breach in three months after Dior and LV Korea. 

Days later, on July 10, UK police arrested four suspects tied to high-profile attacks on M&S, Co-op, and Harrods. 

The group is allegedly linked to Scattered Spider, a domestic threat actor known for social engineering and collaboration with ransomware operators like DragonForce, signaling the growing impact of homegrown cybercriminals on major retailers.

DragonForce hits US retail chain Belk

Between May 7 and 11, 2025, on the other side of the Atlantic, North Carolina, based retailer Belk suffered a data breach.

DragonForce claimed responsibility, stating it exfiltrated 156 GB of customer and employee data, including names, Social Security numbers, emails, order histories, and HR files, which were later posted on its leak site after ransom negotiations stalled.

DragonForce, first emerging in late 2023, operates as a ransomware-as-a-service cartel, listing approximately 136 victims by March 2025, many of whom are in US and UK retail organizations.

Scattered Spider’s tactics have shifted from retail to insurance 

Scattered Spider (UNC3944), a native English-speaking cybercriminal collective, used identity-centric social engineering, voice phishing, MFA fatigue, help-desk impersonation, and typosquatted domains to breach UK retailers (M&S, Co-op, Harrods) in April–May 2025. 

In mid-June 2025, the researchers flagged that Scattered Spider (UNC3944) had shifted from retail to targeting US insurance firms.

• Aflac detected and contained unauthorized access on June 12, 2025; customer and employee personal data (including SSNs, health claims) may have been compromised. 

• Erie Insurance and Philadelphia Insurance Companies also reported similar cyber disruptions in early to mid-June, resulting in operational downtime.

The intrusions matched Scattered Spider’s known tactical profile, though no ransomware was deployed, and systems remained operational.

State-Sponsored and Geopolitical Cyber Activity

Not all cyber threats this summer were about money. 

Nation-state hackers and hacktivists also made their mark, using the turbulent geopolitical climate to launch attacks.

• June 14–17, 2025: Pro-Israel hacktivist group Predatory Sparrow hit Iran’s Bank Sepah, disrupting banking services, then destroyed ~$90M in crypto by breaching Nobitex and sending tokens to burn wallets.

• June 30, 2025: The US Department of Homeland Security and CISA issued a joint alert warning of impending Iranian cyber retaliation targeting critical infrastructure in the US and Europe. 

These incidents serve as a stark reminder that cyber conflict is now a frontline extension of geopolitical tension, one that can ripple far beyond borders and sectors.

Key Vulnerabilities Gaining Public Attention 

Multiple Microsoft SharePoint vulnerabilities were exploited this summer in a widespread cyber espionage campaign known as ToolShell.

• CVE-2025-53770 is a critical remote code execution flaw allowing unauthenticated attackers to run arbitrary code on vulnerable on-prem SharePoint servers. Threat actors used it to deploy web shells, steal credentials, and move laterally through enterprise networks. CISA added the bug to its KEV catalog on July 20, 2025.

• CVE-2025-49704 and CVE-2025-49706 were also added to the KEV on July 22 after being abused in chained attacks. The pair enables authentication bypass and code injection, allowing attackers to exploit unpatched SharePoint systems even if earlier fixes were applied.

The ToolShell campaign targeted organizations across the US, Europe, and the Middle East, including government agencies, energy firms, and telecom providers. 

Security researchers say the attackers likely reverse-engineered Microsoft’s July Patch Tuesday fixes to develop the bypass used in CVE-2025-53770.

What to Take from the Summer Wildfires in Cybersecurity?

From hospitals to retail giants and insurance providers to nation-states, the season exposed cracks in even the most fortified environments. 

Here’s what security teams should do next.

Patch like your life depends on it, because they do in critical sectors.

Start with CISA KEV entries and high-severity CVEs, but don’t stop there. Ask the harder question: are you the kind of target that attackers go after?

Validate whether each CVE is actually exploitable in your environment.

Focus on exploit chains, not just the scores. That’s what adversaries are doing.

Harden identity as your new perimeter.

Social engineering worked better than malware this summer. Stop MFA fatigue attacks, reinforce help-desk verification, and limit privileged access. 

Train your humans, because they were the breach point.

Scattered Spider and others didn’t exploit a CVE; they exploited a person. Run regular simulations, update phishing scenarios, and prepare high-risk roles for real-world lures.

Watch for what happens after initial access.

Threat actors like Interlock and Qilin didn’t just drop ransomware; they moved laterally, staged data, and evaded detection. Implement behavioral monitoring for techniques, such as PowerShell abuse, credential theft, and stealthy exfiltration.

Don’t ignore legacy systems and overlooked infrastructure.

Don’t ignore legacy systems and overlooked infrastructure. The ToolShell campaign exploited unpatched on-prem SharePoint servers, many running unsupported or outdated versions.

Whether it’s aging on-prem SharePoint, appliances, or unmonitored legacy gear, isolate what you can’t upgrade, monitor what you can’t patch, and replace what you’ve ignored.

We strongly suggest simulating the mentioned attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform.

You can also test your defenses against hundreds of other malware and exploitation campaigns, such as Medusa, Rhysida, and Black Basta, within minutes with a 14-day free trial of the Picus Platform.

Sponsored and written by Picus Security.

A wave of data breaches impacting companies like Qantas, Allianz Life, LVMH, and Adidas has been linked to the ShinyHunters extortion group, which has been using voice phishing attacks to steal data from Salesforce CRM instances.

In June, Google’s Threat Intelligence Group (GTIG) warned that threat actors tracked as UNC6040 were targeting Salesforce customers in social engineering attacks.

In these attacks, the threat actors impersonated IT support staff in phone calls to targeted employees, attempting to persuade them into visiting Salesforce’s connected app setup page. On this page, they were told to enter a “connection code”, which linked a malicious version of Salesforce’s Data Loader OAuth app to the target’s Salesforce environment.

In some cases, the Data Loader component was renamed to “My Ticket Portal,” to make it more convincing in the attacks.

GTIG says that these attacks were usually conducted through vishing (voice phishing), but credentials and MFA tokens were also stolen through phishing pages that impersonated Okta login pages.

Around the time of this report, multiple companies reported data breaches involving third-party customer service or cloud-based CRM systems.

LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. each disclosed unauthorized access to a customer information database, with Tiffany Korea notifying customers the attackers breached a “vendor platform used for managing customer data.”

Adidas, Qantas, and Allianz Life also reported breaches involving third-party systems, with Allianz confirming it was a third-party customer relationship management platform.

“On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life Insurance Company of North America (Allianz Life),” an Allianz Life spokesperson told BleepingComputer.

While BleepingComputer has learned that the Qantas data breach also involved a third-party customer relationship management platform, the company will not confirm it is Salesforce. However, previous reporting from local media claims the data was stolen from Qantas’ Salesforce instance.

Furthermore, court documents state that the threat actors targeted “Accounts” and “Contacts” database tables, both of which are Salesforce objects.

While none of these companies have publicly named Salesforce, BleepingComputer has since confirmed that all were targeted in the same campaign detailed by Google.

The attacks have not led to public extortion or data leaks yet, with BleepingComputer learning that the threat actors are attempting to privately extort companies over email, where they name themselves as ShinyHunters.

It is believed that when these extortion attempts fail, the threat actors will release stolen information in a long wave of leaks, similar to ShinyHunter’s previous Snowflake attacks.

Who is ShinyHunters

The breaches have caused confusion among the cybersecurity community and the media, including BleepingComputer, with the attacks attributed to Scattered Spider (tracked by Mandiant as UNC3944), as those threat actors were also targeting the aviation, retail, and insurance sectors around the same time and demonstrated similar tactics.

However, threat actors associated with Scattered Spider tend to perform full-blown network breaches, culminating with data theft and, sometimes, ransomware. ShinyHunters, tracked as UNC6040, on the other hand, tends to focus more on data-theft extortion attacks targeting a particular cloud platform or web application.

It is BleepingComputer’s and some security researchers’ belief that both UNC6040 and UNC3944 consist of overlapping members that communicate within the same online communities. The threat group is also believed to overlap with “The Com,” a network of experienced English-speaking cybercriminals.

“According to Recorded Future intelligence, the overlapping TTPs between known Scattered Spider and ShinyHunters attacks indicate likely some crossover between the two groups,” Allan Liska, an Intelligence Analyst for Recorded Future, told BleepingComputer.

Other researchers have told BleepingComputer that ShinyHunters and Scattered Spider appear to be operating in lockstep, targeting the same industries at the same time, making it harder to attribute attacks.

Some also believe that both groups have ties to threat actors from the now-defunct Lapsus$ hacking group, with reports indicating that one of the recently arrested Scattered Spider hackers was also in Lapsus$.

Another theory is that ShinyHunters is acting as an extortion-as-a-service, where they extort companies on behalf of other threat actors in exchange for a revenue share, similar to how ransomware-as-a-service gangs operate.

This theory is supported by previous conversations BleepingComputer has had with ShinyHunters, where they claimed not to be behind a breach, but just acting as the seller of the stolen data.

These breaches include PowerSchool, Oracle Cloud, the Snowflake data-theft attacks, AT&T, NitroPDF, Wattpad, MathWay, and many more.

To muddy the waters further, there have been numerous arrests of people linked to the name “ShinyHunters,” including those who have been arrested for the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum.

Yet even after these arrests, new attacks occur with companies receiving extortion emails stating, “We are ShinyHunters,” referring to themselves as a “collective.”

Protecting Salesforce instances from attacks

In a statement to BleepingComputer, Salesforce emphasized that the platform itself was not compromised, but rather, customers’ accounts are being breached via social engineering.

“Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks,” Salesforce told BleepingComputer.

“We continue to encourage all customers to follow security best practices, including enabling multi-factor authentication (MFA), enforcing the principle of least privilege, and carefully managing connected applications. For more information, please visit: https://www.salesforce.com/blog/protect-against-social-engineering/.”

Salesforce is urging customers to strengthen their security posture by:

• Enforcing trusted IP ranges for logins
• Following the principle of least privilege for app permissions
• Enabling multi-factor authentication (MFA)
• Restricting use of connected apps and managing access policies
• Using Salesforce Shield for advanced threat detection, event monitoring, and transaction policies
• Adding a designated Security Contact for incident communication

Further details on these mitigations can be found in Salesforce’s guidance linked above.

Crypto custodians are reporting increased interest in their services amid the rising frequency of so-called “$5 wrench attacks” on cryptocurrency traders, investors and project leaders.

In the last year, several high-profile wrench attacks — physical attempts to steal someone’s crypto — have targeted prominent investors and business executives in the blockchain industry. 

The crypto mantra of “not your keys, not your coins” has lost its power among some investors who fear for their personal safety. Cold wallets may offer full control over digital assets, but they also present a single point of attack.

As crypto adoption grows, and wrench attacks persist with the proliferation of more high-value crypto investors, custodians are seeing a shift in preference from self-custody to institutional control. 

Crypto wrench attacks drive security demand

Wrench attacks are nothing new. Jameson Lopp, a Bitcoin (BTC) advocate and chief technology officer of Bitcoin wallet Casa, published a GitHub repository logging hundreds of such incidents since 2014 — and those were only the ones reported in the news.

In the last two to three years, as crypto adoption has sped up and become more mainstream than ever, attacks have grown more public and sophisticated. In January 2025, the founder of crypto wallet Ledger and his wife, David and Amandine Balland, were kidnapped, taken to separate locations and held at ransom. 

Related: Violent crypto robberies on the rise: Six attacks that targeted investors

Just months later, the daughter of an exchange founder barely fought off attackers who attempted to kidnap her in a van on the streets of Paris. Concern over the rise in attacks and their similar methods led French Interior Minister Bruno Retailleau to meet with cryptocurrency professionals to discuss the issue. 

As concern over these attacks grows, crypto custodians are noticing an uptick in interest in their services. 

Emma Shi, over-the-counter and institutional sales director of HashKey, which offers custody and exchange services, told Cointelegraph, “We’re absolutely seeing rising retail anxiety translate into meaningful inflows. Wealthier retail investors are increasingly approaching regulated custodians after high-profile cases like the recent Manhattan kidnapping, where physical coercion was used to access private keys.”

Shi said HashKey’s custody business has noted increased interest in storage from “family offices, crypto-native high-net-worth individuals and even those with nest eggs that are large enough to be vulnerable to theft.”

Cold wallets have long been lauded by crypto advocates as a way to give investors full control over their assets and to keep them maximally secure offline. However, this single key also provides a “single point of failure,” per Wade Wang, CEO of multiparty computation (MPC) crypto custody service Safeheron.

Wang said that there is a “flight to security” among crypto investors, where holders “are actively seeking innovative solutions that eliminate that single point of failure to significantly raise the bar for attacking.”

Already in 2023, a report from PricewaterhouseCoopers on the state of digital custody noted the challenge of cold wallets being prone to theft or loss. One solution posited in the report was MPC or multisignature wallet options. 

Can custody services stop wrench attacks?

Crypto self-custody, while boasting a new technology, runs into the same problem as treasure hoarders throughout history — they were vulnerable to physical attacks and theft until they could share that risk with a stronger and securer institution like a bank. Robbing a bank is a lot harder than robbing a person.

In the same fashion, crypto investors are now seeking to “raise the cost” of the $5 wrench attack. Wang said that investors wish to “return to the fundamental principle: making the cost for an attacker rise exponentially. For example, when it costs $3 million to steal $10 million, the incentive for attack is lost.”

Third-party custody can achieve this and mitigate the problem of wrench attacks, adding time-locks and layers of approval and shifting the target from an individual to the custodian’s employees. 

“But it is not an optimal solution,” per Wang. Trust is still put in a single, centralized institution and, as exemplified by the recent breaches at Coinbase and Bybit, even major regulated crypto businesses are vulnerable to employee misconduct and phishing. 

Related: Lessons from Bybit hack: How to stay safe on crypto exchanges

Wang suggested that distributed custody, such as MPC, “is a superior solution because it fundamentally solves the problem. The core principle of MPC is to use technology to decentralize the single point of control and risk […] into a ‘multiparty’ structure.”

In such a system, control doesn’t belong to any one person, and transferring funds requires complex consensus protocols from multiple parties. 

Decentralized solutions may better reflect the ethos of the blockchain industry, but “we cannot neglect the benefits of centralized custodians,” Wang said. “Reliable security measures bring better assurance of keeping clients’ assets safe, a familiar way of doing things for lots of new crypto players.” 

Centralized or decentralized, crypto investors could still be at risk if the public image of crypto investors is that they are all walking around with cold wallets full of Bitcoin.

Shi said, “The perception of risk matters, too. Attackers often assume holders store funds themselves, so public awareness that more crypto is held in custodial solutions may deter opportunistic assaults.” 

Wrench attacks a “temporary problem” solved by adoption

Public perception is indeed changing. Retail investors are increasingly making crypto part of their portfolio, according to a 2024 report from Ernst & Young. New regulations in large financial markets like the EU and the US are creating the frameworks necessary for institutional investors to get involved.

This regulatory shift has been good for the custody industry as well, as it “legitimizes professional custody for everyday investors and is leading to more offerings from not only crypto-native firms but traditional banks as well,” said Shi.

“We’re seeing crypto adoption accelerate in regions with regulatory clarity, which creates entirely new custody considerations for investors who previously relied solely on self-custody solutions.”

Regulations also raise the stakes of wrench attacks, per Wang. Better regulatory frameworks with more jurisdictions “proactively setting robust regulations” will “inevitably lead to more severe law enforcement actions, which will significantly increase the cost of such attacks and fundamentally curb such behaviors.”

“We see the physical attacking as a temporary challenge,” Wang concluded. 

The crypto industry has evolved through many stages, but the rise of wrench attacks on prominent investors and executives shows that it has yet to reach the maturity of traditional financial markets. 

In the meantime, executives are not only moving their assets to centralized and decentralized custodians but also finding muscle of their own. Personal security firms have also seen an uptick in interest from crypto’s elite to protect their homes and persons.

Magazine: Robinhood’s tokenized stocks have stirred up a legal hornet’s nest

]]> https://earlybirdsinvest.com/wrench-attacks-drive-crypto-investors-to-centralized-custodians/feed/ 0 49795 https://earlybirdsinvest.com/new-crushftp-zero-day-exploited-in-attacks-to-hijack-servers/ https://earlybirdsinvest.com/new-crushftp-zero-day-exploited-in-attacks-to-hijack-servers/#respond Sat, 19 Jul 2025 06:21:53 +0000 https://earlybirdsinvest.com/new-crushftp-zero-day-exploited-in-attacks-to-hijack-servers/

CrushFTP is warning that threat actors are actively exploiting a zero-day vulnerability tracked as CVE-2025-54309, which allows attackers to gain administrative access via the web interface on vulnerable servers.

CrushFTP is an enterprise file transfer server used by organizations to securely share and manage files over FTP, SFTP, HTTP/S, and other protocols.

According to CrushFTP, threat actors were first detected exploiting the vulnerability on July 18th at 9AM CST, though it may have begun in the early hours of the previous day.

CrushFTP CEO Ben Spink told BleepingComputer that they had previously fixed a vulnerability related to AS2 in HTTP(S) that inadvertantly blocked this zero-day flaw as well.

“A prior fix by chance happened to block this vulnerability too, but the prior fix was targeting a different issue and turning off some rarely used feature by default,” Spink told BleepingComputer.

CrushFTP says it believes threat actors reverse engineered their software and discovered this new bug and had begun exploiting it on devices that are not up-to-date on their patches.

“We believe this bug was in builds prior to July 1st time period roughly…the latest versions of CrushFTP already have the issue patched,” reads CrushFTP’s advisory.

“The attack vector was HTTP(S) for how they could exploit the server. We had fixed a different issue related to AS2 in HTTP(S) not realizing that prior bug could be used like this exploit was. Hackers apparently saw our code change, and figured out a way to exploit the prior bug.

“As always we recommend regularly and frequent patching. Anyone who had kept up to date was spared from this exploit.”

The attack occurs via the software’s web interface in versions prior to CrushFTP v10.8.5 and CrushFTP v11.3.4_23. It is unclear when these versions were released, but CrushFTP says around July 1st.

CrushFTP stresses that systems that have been kept up to date are not vulnerable.

Enterprise customers using a DMZ CrushFTP instance to isolate their main server are not believed to be affected by this vulnerability.

Administrators who believe their systems were compromised are advised to restore the default user configuration from a backup dated before July 16th. Indicators of compromise include:

• Unexpected entries in MainUsers/default/user.XML, especially recent modifications or a last_logins field
• New, unrecognized admin-level usernames such as 7a0d26089ac528941bf8cb998d97f408m.

Spink says that they are most commonly seeing the default user modified as the main IOC.

“In general we have seen the default user modified as the main IOC. In general, modified in very invalid ways that were still useable for the attacker but no one else,” Spink told BleepingComputer.

CrushFTP recommends reviewing the upload and download logs for unusual activity and taking the following steps to mitigate exploitation:

• IP whitelisting for server and admin access
• Use of a DMZ instance
• Enabling automatic updates

However, cybersecurity firm Rapid7 says using a DMZ may not be a reliable strategy to prevent exploitation.

“Out of an abundance of caution, Rapid7 advises against relying on a demilitarized zone (DMZ) as a mitigation strategy,” warned Rapid7.

At this time, it is unclear if the attacks were used for data theft or to deploy malware. However, managed file transfer solutions have become high-value targets for data theft campaigns in recent years.

In the past, ransomware gangs, usually Clop, have repeatedly exploited zero-day vulnerabilities in similar platforms, including Cleo, MOVEit Transfer, GoAnywhere MFT, and Accellion FTA, to conduct mass data theft and extortion attacks.

Russian professional basketball player Daniil Kasatkin was arrested in France at the request of the United States for allegedly acting as a negotiator for a ransomware gang.

Daniil Kasatkin is a Russian basketball player who briefly played NCAA basketball at Penn State before returning to Russia in 2019. In four seasons with MBA-MAI, he appeared in 172 games before he left the team.

According to French media, Kasatkin was arrested at Paris’s Charles de Gaulle airport on June 21st after landing in France with his fiancée.

The arrest was made as part of a United States international arrest warrant for his role as an alleged negotiator for a ransomware gang.

Kasatkin is now under custody while the US seeks to have him extradited to face charges of “conspiracy to commit computer fraud” and “computer fraud conspiracy.”

His lawyer alleges that Kasatkin is not guilty of these crimes and that they are instead linked to a second-hand computer that he purchased.

“He bought a second-hand computer. He did absolutely nothing. He’s stunned ,” his lawyer, Frédéric Bélot, told the media.

“He’s useless with computers and can’t even install an application. He didn’t touch anything on the computer: it was either hacked, or the hacker sold it to him to act under the cover of another person.”

While the name of the ransomware gang was not disclosed, it is reported to have been behind attacks on more than 900 companies, including two federal agencies, between 2020 and 2022.

This description closely matches similar language used by the Department of Justice to refer to the notorious Conti ransomware gang, which emerged as a successor to Ryuk in 2020 and shut down in 2022, following a data breach.

However, it was not previously reported that Conti breached any federal agencies, though they are linked to attacks on state governments.

Last month, French police also arrested four alleged operators of the BreachForums hacking forum, including threat actors using the alias IntelBroker and ShinyHunters.