‘Infamous Chisel’ malware threat flagged by global security agencies

A coalition of security agencies from Canada, Australia, New Zealand, the United States, and the United Kingdom has raised alarm over a new malware targeting digital currency exchanges and their wallets.

Per a joint security report, the malware targets only Android devices, stealing a trove of personal information from victims. Dubbed the “Infamous Chisel,” the malware has links with Sandworm, a state-backed entity under Russia’s military, according to the report.

The malware was originally designed to extract information from the Ukrainian military as part of a cyberwarfare strategy. However, an analysis of the inner workings of the malware indicates that its application is not limited to military use cases but extends to digital assets as well.

Infamous Chisel has been shown to extract data within the directories of digital currency exchanges, including Binance and Coinbase (NASDAQ: COIN). Per the report, the malware also extracts information from Trust Wallet, but the extent of the financial damage remains unclear.

“The malware periodically scans the device for information and files of interest, matching a predefined set of file extensions,” read the joint report. “It also contains functionality to periodically scan the local network collating information about active hosts, open ports, and banners.”

According to the report, bad actors behind the malware rely on the Tor network to cover their tracks while siphoning data from affected devices.

Despite anonymous communication tools, the joint report surmised that Infamous Chisel makes only an insignificant attempt towards the “concealment of malicious activity.” Experts say the absence of stealth techniques is linked to the lack of “host-based detection systems” for Android devices.

However, the malware makes up for its lack of stealth techniques and extensive functionalities. Aside from data extraction, Infamous Chisel is capable of traffic collection, network scanning, SSH access, remote access, SCP file transfer, and network monitoring.

Agencies contributing to the report include:

• The U.K. National Cyber Security Centre (NSCS).
• The U.S. Federal Bureau of Investigation (FBI).
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA).
• Australian Signals Directorate (ASD).
• New Zealand’s National Cyber Security Center (NCSC-NZ).

Security breaches flooding the ecosystem

Since the start of 2023, on-chain analysts have noted a spike in Web3 exploits and hacks, triggering losses of nearly $1 billion.

CertiK pointed out in a report that flash loan attacks are also popular, netting over $40 million for bad actors in August. Exit scams have also contributed their fair share as law enforcement agencies continue to step up their efforts at recovering stolen funds from bad actors.

In February, Norwegian authorities recovered $5.9 million from the perpetrators of the infamous Ronin hack after months of following the money trail.

The increasing number of cyberattacks highlights the need for a tool that will ensure the security of one’s data, such as Certihash’s Sentinel Node, which was showcased during the London Blockchain Conference earlier this year.

The BSV blockchain-powered cybersecurity tool can detect breaches, alert system operators, and come up with a step-by-step solution to deal with the attack and prevent its recurrence.

Sentinel Node is only among a variety of tools built on the BSV blockchain that could help mitigate cyberattacks at a low fee.

“Cybersecurity tools should not only be accessible but also affordable to any company or institution that needs to protect its data. With the BSV blockchain, we’re able to lower costs because of its inherent scalability. There is no reason that this technology cannot be adopted by schools, hospitals, and small businesses, in addition to multinational companies,” said Co-Creator Bryan Daugherty.

Watch Sentinel Node: Blockchain Tools to Improve Cybersecurity