ELECTRUM

Electrum, a threat actor identified in cyberattacks against Ukraine on February 1, 2022, is known for its Bitcoin-themed attacks. These attacks often involve the use of PDF delivery documents referencing Electrum Bitcoin wallets, similar to those seen in subsequent attacks in April. The initial loader Trojan downloaded by JavaScript in the delivery document was signed using a certificate that includes "Electrum Technologies GmbH" within the organization field. This Trojan serves as the initial point of entry, allowing the threat actor to infiltrate and compromise systems. The threat actor has been associated with significant financial risks, particularly around cryptocurrency wallets. Atomic Stealer, a malware variant used by Electrum, targets crypto wallets such as Electrum, Binance, Exodus, Atomic, and Coinomi, potentially leading to substantial financial losses for investors if their wallets are compromised. The malware also enables the theft of browser data and assets from cryptocurrency wallets. It extracts data from various crypto wallet apps, including Atom, Armory, Electrum, and Exodus, and targets applications including major currency apps (Electrum, Ethereum, Exodus, Jaxx, and Monero), popular browsers, and email clients. Electrum's activities have not been limited to financial cybercrime; they have also been implicated in cyber-espionage related to geopolitical conflicts. For instance, the group has been linked to repeated power grid outages in Ukraine, suggesting a focus on infrastructure attacks. Another group, Kamacite, appears to work in tandem with Electrum, gaining initial access to systems and then handing it off to Electrum, which functions as an "ICS effects team." The increase in tensions between countries like Ukraine-Russia and China-Taiwan has prompted mature threat groups like Electrum to escalate their activities, leading to increased targeted cyber espionage attacks against industrial organizations in the Asia-Pacific region and the United States.