A cybercrime group known as “GreedyBear,” has stolen over $1 million in cryptocurrency during a multi-faceted, large-scale attack, cybersecurity firm Koi Security discovered.
Unlike most cybercriminals, who focus on one tactic, GreedyBear attacks using three different vectors in tandem, making it an extremely coordinated crime. These methods are fake browser wallet extensions, crypto-targeting malware, and scam websites.
According to Koi Security researcher Tuval Admoni, “Most groups pick a lane — maybe they do browser extensions, or ransomware, or phishing sites. GreedyBear said, ‘Why not all three?’ And it worked. Spectacularly.” Admoni said the group has used over 650 malicious tools aimed at crypto wallet users, stealing more than $1 million in the process.
Fake Wallet Extensions, Malware, and Scam Sites
The group has published over 150 fake crypto wallet browser extensions on the Firefox marketplace. These copy popular wallets like MetaMask, TronLink, Exodus, and Rabby Wallet.
At first, the extensions are harmless to pass Firefox’s review process. Once approved and trusted by users, the criminals update them with malicious code to steal wallet passwords and private keys directly from the wallet interface.
GreedyBear has also distributed nearly 500 malware programs aimed at stealing cryptocurrency. They include password stealers such as LummaStealer that steal wallet information, and ransomware such as Luca Stealer that encrypts devices until victims make payments in crypto. Many of these malicious files are spread through Russian websites offering pirated or cracked software.
Their third part is a system of imitation crypto product websites. They are not only imitating login pages, but they are meant to resemble authentic landing pages for digital wallets, hardware devices, or wallet repair services. In actuality, they are decoys to capture sensitive data from unsuspecting visitors.
A Single Control Hub
All of these attacks are traced to a single server and IP address. It controls stolen information, facilitates ransomware requests, and carries scam websites. Experts also think that GreedyBear is employing AI-generated code to facilitate the production of new attacks at a faster rate, making them more difficult to block.
Cybersecurity experts warn this may be the “new normal” in crypto theft, urging stricter extension store security checks, more transparency from developers, and extra caution from users before installing extensions or downloading software.