CryptoCore_Group.pdf (1 MB)

ClearSky profiles CryptoCore, a financially motivated group targeting cryptocurrency exchanges and related supply-chain entities, mainly in the United States and Japan, since at least 2018. The group’s objective is access to exchange wallets and password managers, often reached through reconnaissance, executive email targeting, and spear-phishing that impersonates senior staff or trusted business contacts. Its campaigns commonly use Google Drive-themed lures, malicious crypto-themed domains, bit.ly tracking links, disguised LNK downloaders, and VBS backdoors such as CageyChameleon to collect host and user information. ClearSky also highlights rapidly changing infrastructure, repeated use of dedicated domains and DDNS services, and a case where newly registered infrastructure was used against a client within 30-40 minutes of notification.