Record-Setting Bitcoin Price Sparks Another Global Phishing Attack
By: Owen Lystrup
Tags: Bitcoin, Phishing, Featured, Cryptocurrency, Blockchain

Researchers at Cisco’s Country Digitization Acceleration team and Cisco Umbrella this week discovered two active global phishing campaigns targeting bitcoin users or those interested in bitcoin through malicious Google ads. First noticed on February 24, the phishing campaigns launched just in time for the price of bitcoin hit yet another all-time high. Bitcoin is currently experiencing the longest stretch above a $1,000 price point in its history.

The researchers say the target of these massive phishing efforts seem to be Internet users from developing nations who searching for information about blockchain the technology or looking to find the popular tech startup of the same name.

The culprits also appear to be the same individuals behind previous phishing attacks that targeted bitcoin users during previous spikes.

What Is blockchain and Blockchain

Blockchain the technology is commonly described as a digital ledger. It is a database built on digital transactions called blocks — typically financial in nature, like the exchange of bitcoin — both chronologically and publicly. For more information on that, see this article. Blockchain the company is a tech startup based in Luxembourg, and owns the site blockchain[.]info. In fact, that is what shows up first if you Google “blockchain.”

A comparison of the traffic spike from one of the dozens of domains used in the phishing attack (top), and the normal traffic levels for Blockchain.net (above). The price of bitcoin peaked on Febraury 23.

It is not a bitcoin exchange, if you are familiar with those. But Blockchain does provide similar services, most notably digital wallets for currencies like bitcoin. The company, according to its website, it is “noncustodial,” meaning it does not control or access its customers’ currency at any point. Instead of thinking of it like a bank, think of it instead as a backup service, a backup for your digital money.

However, with stolen credentials to a Blockchain wallet, a crook like the ones running malicious Google ads and fraudulent phishing sites, could potentially steal your digital money, personally identifiable information and login credentials.

When You See Blokchien, but Read Blockchain

Jeremiah O’Connor, a senior security researcher with Cisco said attackers are opting to use malicious Google ads to act as a gateway to redirect users who click them to fraudulent sites that spoof the official Blockchain[.]info. The ads prove to be an effective technique in that they appear as the first search result to anyone searching for the word “blockchain.” They are also capitalizing on the timing of bitcoin surging to an all-time high twice in the same week. The attacks also surfaced right around the time of bitcoin’s peak price.

One of the bitcoin phishing campaigns uses compromised Google Adwords accounts to post malicious ads when unsuspecting users search for bitcoin information.

Users searching for “blockchain” in Google would find a results page with an ad at the top that may, at quick glance, look like a legitimate bitcoin site. When clicked, it directs the user to a URL spoofing the legitimate blockchain[.]info site. Those not careful would easily miss that the site’s URL was actually “blockchian[.]com.”

O’Connor and other researchers at Cisco Umbrella have been tracking these types of phishing campaigns since last year, and there is evidence the attackers have taken their time to stage operations in wait for a spike in bitcoin price.

Targeting Developing Nations

According to research from O’Connor and colleague security researcher Artsiom Holub at Cisco Umbrella (formerly OpenDNS), there are dozens of domains dedicated to bitcoin phishing in these two campaigns, most targeting Blockchain users likely because of its popularity and Google ranking. Most domains associated with these campaigns experienced short traffic spikes right at the time of the spike in bitcoin price or in the two days following. The more trafficked domains saw more than 200,000 requests in a single day, totaling somewhere near half a million, though it’s difficult to calculate an exact total. After a few days, the domains are taken down and traffic falls off completely.

For reference, the Blockchain[.]info website analyzed with the same dataset, peaks around 50,000 requests daily.

The origins of users visiting blockchalna[.]info, a bitcoin phishing site hosted in Ukraine. Nigeria, Ghana and Estonia are the top three country origins.

The domains behind these phishing scams are mostly hosted in Ukraine, Russia and a couple other Eastern European countries. But victims visiting the fraudulent sites are distributed widely across the globe, though not in a way that mimics regular Internet traffic, in which the U.S. typically accounts for the largest share, followed by countries like China, the U.K., Germany and so on. Instead, the targets seem to be from predominantly developing countries and those that have unstable economies, are experiencing hyper-inflation, have rocky political standing or are underdeveloped economically.

This forum was created only a few days ago and is operating on the openweb, hosted on the same IP space as the phishing campaign.

“One thing that’s also interesting, which came up late in the investigation,” O’Connor said. “is the way the actors are moving the attack around between hosts. Each malicious Google ad acts as a gateway, which will be hosted on Russian IP space. The Google ad then redirects the user to a landing page with a different IP and URL, which is hosted on Ukrainian IP space.” Further, O’Connor and contributing researchers found that the same Russian IP space also hosts at least one newly created darkweb forum that offers various fraudulent services like money laundering, fake passports, fraudulent work visas and other services.

The Bank in Your Pocket

Visualization for just one of the phishing campaigns. Researchers at Cisco have been tracking this actor for nearly a year. — The orange dots are the host IP addresses, white dots are the registrant e-mail addresses, and blue dots are the registered phishing domains. Source: Cisco Umbrella Data Visualization Designer Austin McBride.

Two of the most interesting facets to these campaigns are the scale and the countries targeted. Bitcoin is a global, distributed currency. It’s common to see inordinate spikes in adoption from countries that have limited access to banking or volatile currency and political conditions. Citizens in those countries often seek an alternative methods to pay for goods and store their money.

The top country domains observed visiting the phishing pages in this campaign targeted include countries in Africa, Eastern Europe, South America and other continents where banking can be more difficult for the average citizen.

Bulletproof Hosts

Through their investigation of the hosting companies involved in prior bitcoin phishing campaigns, the research teams at Cisco discovered that so-called bulletproof hosts provide an essential service to the campaign’s success. “Were it not for the support of the same bulletproof or anonymous hosts in offshore jurisdictions who’ve historically provided infrastructure for bad actors, this current spate of Bitcoin wallet phishing would be without a launchpad,” they wrote in a blog post.

Users tricked by a malicious Google ad would end up at a fairly convincing phishing site like this one.

Bulletproof hosts are those that provide anonymous offshore website hosting and turn a blind eye to domain abuse. Some will even provide help with Google Adwords placement, and help avoiding law enforcement. As such, they are often host to sites that serve malware, phishing, ransomware, botnets or that run DDoS services.

In the current bitcoin phishing campaigns, O’Connor said the primary hosts for the phishing sites are Belcloud in Bulgaria, Highload Systems in Ukraine, Unitednet in Russia.

While Cisco Umbrella is actively blocking the domains found through its automated security engine, this is very much an active campaign. O’Connor said there is clear evidence that the attackers are currently working to stage new domains, currently lying dormant, that will target Blockchain users in the future. New domains were being discovered even at time of publishing.

How to Protect Your Wallet

Blockchain has a good track record of warning its customers about current phishing campaigns through support forums and social channels. But as this is an ongoing campaign, it’s best to proactively secure your bitcoin wallets and transactions.

Blockchain specifically — as many cryptocurrency companies do — provides a number of security measures to help users guard their accounts. Heavy encryption for both transactions and messages are standard. Blockchain also offers e-mail verification for logins, plus two-factor authentication via SMS, a login app like Google Authenticator or a Yubikey device. It also provides a recovery phrase measure, which can help restore a wallet and the funds in it if a password or account access are lost.

Users of Blockchain can visit the company’s security center to learn more about the security features offered.

No measure is completely perfect of course, but at least with these protocols in place it would take more than a stolen password to pilfer your bitcoin.

Editor’s note: Special thanks to Jeremiah O’Connor, Artsiom Holub and Data Visualization Designer Austin McBride, who contributed to this article.