Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

MITRE Techniques

• [T1589.002 ] Gather Victim Identity Information: Phone Numbers – Bulk phone-number datasets were used to identify likely crypto users, narrowing targets through validation. (‘bulk-validates phone numbers’ / ‘The server had approximately 885,000 phone numbers’)
• [T1583.003 ] Acquire Infrastructure: Virtual Private Server – The operation used hosted infrastructure for panels, payloads, and control services. (‘infrastructure used to support’ / ‘centred on a single host’)
• [T1587.001 ] Develop Capabilities: Malware – Fake wallet applications were built on the server for theft and delivery. (‘Fake Trezor Suite, Ledger Live, and Exodus applications were built on the server’)
• [T1588.002 ] Obtain Capabilities: Tool – The operator relied on reusable tooling and builders to support the campaign. (‘rebrandable Malware-as-a-Service builder’)
• [T1608.001 ] Stage Capabilities: Upload Malware – Malware and build artifacts were staged on exposed infrastructure. (‘malware was built and staged on an open-directory server’)
• [T1566.002 ] Phishing: Spearphishing Link – Fake documentation and support pages delivered malicious install flows. (‘fake Trezor Suite documentation page and fake Claude Code installation page’)
• [T1189 ] Drive-by Compromise – A legitimate-looking install command was replaced with attacker-controlled code on a cloned page. (‘replaced the legitimate installation command with an attacker-controlled script’)
• [T1204.002 ] User Execution: Malicious File – Victims were induced to install fake wallet applications manually. (‘User manually installed the fake wallet application’)
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The fake Claude page used shell commands to launch the payload. (‘curl -fsSL | bash’)
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – A Windows delivery path used PowerShell to execute remote content. (‘irm | iex’)
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – Electron app logic executed phishing and exfiltration behavior in JavaScript. (‘Electron main-process files, including index.js and trezor-monitor.js’)
• [T1543.001 ] Create or Modify System Process: Launch Agent – macOS persistence was established with LaunchAgents. (‘com.trezormovement.agent was written at runtime’)
• [T1547.001 ] Boot or Logon Autostart: Registry Run Keys – Windows persistence logic referenced Run keys, though it was inert in the sample. (‘HKCUSoftwareMicrosoftWindowsCurrentVersionRun’)
• [T1036 ] Masquerading – The malware impersonated legitimate wallet software and related services. (‘Malware impersonated Trezor Suite, Ledger Live, and Exodus’)
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – Names, icons, and bundle identifiers were made to resemble real products. (‘Application names, icons, and bundle identifiers matched legitimate software’)
• [T1027 ] Obfuscated Files or Information – Obfuscation was used to hide or complicate analysis. (‘javascript-obfuscator was used’ / ‘control-flow flattening’)
• [T1553.001 ] Subvert Trust Controls: Gatekeeper Bypass – Victims were instructed to bypass macOS security prompts. (‘right-click and select Open’)
• [T1564.003 ] Hide Artifacts: Hidden Window – The fake app ran in a nearly invisible Electron window. (‘1×1 pixel BrowserWindow with opacity: 0’)
• [T1601 ] Modify System Image – The app.asar payload was swapped after packaging. (‘app.asar was replaced after packaging’)
• [T1057 ] Process Discovery – The malware repeatedly scanned for the legitimate wallet process. (‘scanned the process list for Trezor Suite’)
• [T1082 ] System Information Discovery – The code checked the platform to choose macOS or Windows behavior. (‘process.platform was used to select the darwin or win32 configuration’)
• [T1056.003 ] Input Capture: Web Portal Capture – Fake forms collected recovery phrases and passphrases. (‘a fake seed-entry form collected 12-, 18-, 20-, or 24-word BIP39 recovery phrases’)
• [T1115 ] Clipboard Data – The Ledger Live Windows build replaced copied crypto addresses. (‘clipboard hijacker that replaced cryptocurrency addresses’)
• [T1185 ] Man-in-the-Browser – The genuine wallet was terminated and replaced by a counterfeit interface. (‘The genuine wallet application was terminated and replaced with a fake application’)
• [T1102.001 ] Web Service: Dead Drop Resolver – Telegram Bot API served as the exfiltration endpoint. (‘api.telegram.org’ / ‘used as an exfiltration dead drop’)
• [T1571 ] Non-Standard Port – A checker communicated with a service on port 1337. (‘136.0.213.184:1337’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – The campaign used HTTPS web requests for exfiltration and lookup. (‘HTTPS communications were made to api.telegram.org and api.ipify.org’)
• [T1567 ] Exfiltration Over Web Service – Stolen phrases and metadata were sent out via Telegram. (‘sent to a Telegram bot’)
• [T1489 ] Service Stop – The malware killed the legitimate wallet process to force replacement. (‘kill -9 terminated the genuine Trezor Suite’)
• [T1657 ] Financial Theft – Stolen recovery seeds gave full access to victim wallets. (‘provides full access to the victim’s cryptocurrency wallet’)