Universal Method for Removing Spyware Programs
Not long ago, one of the subscribers of the channel CyberYozh on Telegram reached out to me. The essence of his problem was outlined on the channel ITsec market, where we publish requests for help on IT security issues for free.
He had $30,000 worth of cryptocurrency stolen from various wallets and exchanges. The presence of multiple resources at once allows us to discard the option of a vulnerability in a specific exchange or wallet. But could it be that he himself exhibited incredible carelessness?
Not at all. He used a Mac and was familiar with the basic rules of safe data handling. Notably, the cryptocurrency was stolen from him while he was on a plane and could not find out what had happened. In my opinion, it can only be attributed to a well-planned attack, and the attackers had access to the victim's laptop, which made it possible to gain access to all accounts.
The hunt for cryptocurrency is not only carried out by denizens of the dark web, but also by government North Korean hackers. Every day they go to work to develop software aimed at stealing money. This is their duty to their homeland, and they fulfill it diligently.
According to publicly available statistics, North Korean hackers stole about $570 million in cryptocurrency just in 2017-2018. I suspect that in our case, the person became their victim.
If your device is infected by ransomware, the results of its activity will soon become noticeable: it is quite difficult not to notice when almost all files and documents are encrypted. But what to do if the program is designed for espionage, quietly installed on your computer, and is collecting data?
Sometimes the target is cryptocurrency, and sometimes it is you and your data. Recently, several critical vulnerabilities have been discovered that can lead to full access to computers running Windows, macOS, and Linux simply by the victim opening a link.
One of the latest is a combination of vulnerabilities in Chrome (CVE-2019-5786) and Windows 7, which hackers actively exploited; we wrote about it on our channel https://t.me/itsec_news