NYC Mayor to Convert His First Paycheck to BTC and ETH via Coinbase

SHIB Technical Analysis: Sellers Drive the Price Below $0.000020 

El Salvador Just Bought 410 BTC for $15M

ENJ Technical Analysis: Triangle Fallout Relays a Selling Race  

BlackRock to Track Blockchain and Crypto Firms With New ETF

Users of Tor Network are at risk of losing their cryptocurrencies to a continuous large-scale cyberattack, launched in early 2020. Reportedly, <a href="https://www.cryptoknowmics.com/news/hacker-sells-personal-data-of-1m-dominos-india-customers-for-10-bitcoin/">an unknown hacker</a> has been placing a large-scale attack on the Tor Network for over a year, hijacking up to 25% of its “exit relay” capacity. The attacked nodes are then moving to modify users' data to steal their cryptocurrencies.
<h2>Malicious Tor Network Relays Stealing Users’ Cryptocurrencies</h2>
According to a <a href="https://nusenu.medium.com/how-malicious-tor-relays-are-exploiting-users-in-2020-part-i-1097575c0cac" target="_blank" rel="nofollow noopener">report</a> published by a cybersecurity researcher and Tor node operator, Nusenu an unidentified hacker has been adding thousands of malicious servers to the Tor network for over a year.

Despite being shut down several times, the attacker continues to track, steal and attack crypto users of the network even today.

Apparently, the threat actor has been adding malicious servers to the Tor network since the early 2020s, making them exit relays. These are done in order to track users accessing cryptocurrency-related sites.

The attacker then moves to downgrade traffic to HTTP in order to replace cryptocurrencies addresses with their own to steal users' cryptocurrencies.

Reportedly, over the past 16 months, the developers of the Tor network have shut down the hacker’s servers at least three times already. However, the hacker is constantly rebuilding its network. Interestingly, up to 10% or even more of Tor’s exit relay capacity could still be controlled by the attacker to this day.
<h2>Tor Exit Nodes Exploiting Cryptocurrency Users</h2>
Tor is free and open-source software that allows users to anonymize their Internet traffic by sending it through a network of servers operated by volunteers.

Taking advantage out of this, an unknown attacker (acting as a volunteer) has been adding their own malicious nodes as “exit relays,” to the network. Apparently, the hacker modified the code that allows him to pinpoint cryptocurrencies related traffic and modify it before sending it out.

It is believed that the hacker used Tor netwrok servers to switch crypto addresses in transaction requests made by users and redirect their <a href="https://www.cryptoknowmics.com/news/heres-why-many-people-advocate-for-the-cold-wallet-storage-of-cryptocurrencies/">cryptocurrencies</a> to their own wallets.

Malicious Tor Relays Are Exploiting Users’ Cryptocurrencies

The United State's FBI officers<a href="https://sophosnews.files.wordpress.com/2020/03/firsov-indictment.pdf"> arrested</a> a Russian citizen, Mr Kirill Victorovich Firsov under alleged Russian cyber-crime charges. Mr. Firsov was detained on March 7 as he had just arrived in JFK New York City airport. His company, Deer.io is always being investigated for selling stolen credentials on an online platform. The California Court revealed this on 9th March and Firsov will be facing charges later this week.

Deer.io became public in 2016 as an underground marketplace specializing in stolen goods. A famous hacker, Tessa88 had used the platform to sell sensitive data hacked from Myspace and LinkedIn.

The documents unsealed before the court show that Firsov is the founder of deer.io. An online platform, that hosted more than 24,000 stores for selling hacked usernames and passwords for a variety of top online marketers. Deer.IO has been offering illegal services in exchange for Bitcoins. To date, it has accumulated an estimate of $17 million since it began. Some of Firsov charges include Aiding and Abetting fraud through his site.
<h2>How was he caught?</h2>
The website in question has a platform called Storefront where personal identification materials and stolen credentials used for theft and hacking services are sold. On March 4, the FBI decided to buy 1100 gamer accounts worth $20 from the storefront to confirm if the site is legal.

After reviewing over 250 storefronts, many compromised accounts were found. Some including video game accounts and PII files. The PII files contain user names, dates of birth, passwords, U.S. Social Security Numbers, and victim addresses.

According to the indictment on Firsov, there are a number of clues that link Firsov as the mastermind behind deer.io. Indeed, one of the early adopters of deer.io was a shop called Dedushka, a service offering fake accounts that were common among criminals involved in numerous online dating scams.

Secondly, Deer.IO was advertised on Antichat, a Russian public hacking site by one Isis. Using the username"Firsov" Isis often posted all the hacking competitions he had won. Firsov also tweeted about competing and winning several hacking competitions at the Positive Hack Days (PHDays) in Moscow.

Moreover, the same email address (hm@mail.ru) used to register Isis on several<a href="https://www.cryptoknowmics.com/crypto/greece-to-arrest-russian-cyber-criminal-for-money-laundering/"> cybercrime forums</a>, is the same one used to register accounts on social media in the name of Kirill Firsov. In addition, this site helped in facilitating the sale of hacked accounts in video streaming services like Hulu, Netflix and social media.

The FBI says that this platform is running no legitimate business and is posing as a great risk to users privacy.

According to Mr Firsov- when explaining his business to ZDNet in 2016- Deer.io works according to the laws of Russia. They block shops that steal bank accounts and sell drugs. His clients can also create shops that do not violate laws and will block any shop if requested by the authorities of the Russian Federation.
<h2>How does it work?</h2>
In conclusion, the black market entrepreneurs pay $12.50 to Firsov in<a href="https://www.cryptoknowmics.com/crypto/bitcoin-related-google-searches-increases-up-to-33-in-past-week/"> Bitcoins (BTC)</a> or via Web Money to gain access. They sell items like user passwords, fake social media accounts, birth certificates and tax returns on the platform.

You May Also Read.
<ul>
 	<li style="font-weight: 400"><a href="https://www.cryptoknowmics.com/crypto/fbi-fears-crypto-is-a-security-threat-that-will-get-bigger-and-bigger/">FBI Fears Crypto is a Security Threat That Will Get ‘Bigger and Bigger’</a></li>
 	<li style="font-weight: 400"><a href="https://www.cryptoknowmics.com/crypto/indian-authorities-indicts-crypto-dark-web-narcotics-dealer/">Indian Authorities Indicts Crypto Dark Web Narcotics Dealer</a></li>
 	<li style="font-weight: 400"><a href="https://www.cryptoknowmics.com/crypto/us-think-tank-investigation-report-into-dark-web-transactions/">US Think Tank Investigation Report into Dark Web Transactions</a></li>
</ul>

Malicious Tor Relays Are Exploiting Users’ Cryptocurrencies

FBI Arrest Deer.io Founder Over Cyber-Crime Allegations

Features

News

Industry

Market Analysis

Newsletter Sign up

Advertisement