Blackberry's Research Identifies Financially Motivated Cyber Attacks on Mexican Cryptocurrency Exchanges and Banks

Blackberry's research and intelligence arm, a former cellphone market titan, has discovered and alerted the public about a financially motivated attacker. This threat specifically targets numerous high-net-worth Mexican cryptocurrency exchanges and banks.

Attack Strategy and Targeted Institutions

According to Cointelegraph, Blackberry's report reveals that the attack aims to steal sensitive user information from banks and crypto trading services. The attackers utilize an open-source remote access tool called AllaKore RAT, which they attempt to install in company-run computers and databases. The threat actors hide behind official naming schemes and links to avoid raising employee suspicion.

Deep analysis of the AllaKore RAT payload shows it has undergone significant modifications. These modifications enable the threat actors to send stolen banking credentials and unique authentication information back to a command-and-control (C2) server for financial fraud purposes. As per ADVFN, the threat targets large companies with over $100 million in gross revenues, directly reporting to the Mexican Social Security Institute (IMSS).

Geo-location and Regional Attribution

Most traced attacks originate from Mexico Starlink IPs, suggesting a local connection. Additionally, the modified RAT payload uses Spanish-language instructions, leading Blackberry to conclude that the threat actor is based in Latin America.

The newer iterations of AllaKore RAT employ a more complex installation process. The attackers now deliver the software to their targets using a Microsoft software installer (MSI) file. The software is only executed if the victim is located in Mexico.

However, the threat is not limited to large banks and crypto trading services. The same method targets prominent Mexican corporations across various industries: retail, agriculture, public sector, manufacturing, transportation, commercial services, and capital goods.

Rising Success of Basic Phishing Attacks

Cyber attacks executed through basic phishing techniques continue to increase and succeed in stealing funds. On January 20, a security breach exposed contact information for nearly 66,000 Trezor hardware wallet users. Trezor, the hardware wallet manufacturer, clarified that no user funds were compromised during the incident. Nevertheless, at least 41 users received direct email messages from the attacker seeking sensitive recovery seed information.

Increased cyber threats targeting financial institutions require more robust security measures and awareness. Companies must remain vigilant to protect sensitive user data and funds from malicious actors. Industry leaders like Blackberry play a significant role in identifying and alerting the public about emerging threats.

Photo: PR Newswire