#BlackWallet
LightNews LightNews
kagank.bsky.social
Rico Industries Tri-Fold#RicoIndustries#TriFoldWallet#NFLWallet#LeatherWallet#BlackWallet
Rico Industries Tri-Fold
www.amazon.com
November 7, 2026 at 12:55 PM
epsteinweb.bsky.social
Parts 1-2/2 — EFTA00162787.jpg
#epsteinweb #efta00162787
https://epsteinweb.org
Available in the iOS app store now!
https://apps.apple.com/us/app/epstein-web/id6758880661
EFTA00162778 | EFTA00162787 NA Other: 1 - North Korea Targeted South Korean Cryptocurrency Users and Exchange in Late 2017 Campaign https://www.recordedfuture.com/north-korea-cryptocurrency-campaign/ • Recent reporting regarding North Korean attacks against cryptocurrency exchanges and using Pyeongchang Olympics as a lure describe techniques that are unusual for the Lazarus Group. These include leveraging PowerShell, HTA, JavaScript, and Python, none of which are common in Lazarus operations over the last eight years. The campaign we discovered showcases a clear use of Lazarus TTPs to target cryptocurrency exchanges and social institutions in South Korea. • This campaign leveraged four different lures and targeted Korean-speaking users of the Hangul Word Processor (.hwp file extension), a Korean-language word processing program utilized widely in South Korea. North Korean state-sponsored actors have used Hangul exploits (CVE-2015-6585) and malicious .hwp files in the past, including during a phishing campaign in early 2017, to target South Korean users. • Beyond Korean-speaking HWP users, targets of this campaign appear to be users of the Coinlink cryptocurrency exchange, South Korean cryptocurrency exchanges at large (or at least those that are hiring), and a group called "Friends of MOFA" (Ministry of Foreign Affairs), which is a group of college students from around South Korea with "a keen interest in foreign affairs." • This campaign relies on a known Ghostscript exploit (CVE-2017-8291) that can be triggered from within an embedded PostScript in a Hangul Word Processor document. • The attack chain occurs in multiple stages with the PostScript deobfuscating a first stage shellcode that's been XORed with a hardcoded four-byte key. The shellcode in turn triggers the GhostScript vulnerability in order to execute an embedded DLL that has also been XORed. A PwnCode.Club blogpost details the deobfuscation of the shellcode and loading of the DLL into memory. 2 - $400,000 Stolen in Lumens BlackWallet Theft http://www.zdnet.com/article/400000-stolen-in-lumens-blackwallet-theft/#ftag=RSSbaffb68 • Unknown threat actors have compromised the BlackWallet application and stolen $400,000 in user funds. • The Stellar Lumen (XLM) cryptocurrency was the target of the attack and by redirecting the DNS server to a server controlled by the attacker, close to 670,000 Lumens was stolen. • When the theft took place, over $400,000 was contained in the attacker's wallet. At the time of writing, roughly $48,000 in funds has been left following a number of transfers taking place over the past two days. • The exploit used was a code injection. If over 20 Lumens was held by users, the funds were automatically transferred over to the attackers' wallet. • In a statement, the creator of BlackWallet said that an unknown individual had managed to access their hosting provider account, leading to the DNS changes and compromise of user funds. 3 - OnePlus Suspends Credit Card Payments After Customers Report Fraudulent Purchases https://www.theverge.com/2018/1/16/16895858/oneplus-credit-card-details-stolen-cybersecurity-fraud • OnePlus has temporarily shut down credit card payments on its website following reports that customers' payment details were stolen after they bought goods through its online store. The company says it's disabling credit card payments "as a precaution," but will still be accepting purchases through PayPal. OnePlus also says it's looking for "alternative secure payment" options. EFTA00162787
April 23, 2026 at 6:11 AM