The Analyst Prompt #16: Monero's Hard Fork Enhances Privacy and May Make It More Attractive to Cybercriminals

New & Noteworthy: Monero Hard Fork Improves Privacy – Bitcoin Will Likely Remain Criminals’ ‘Favorite’

On August 13th, 2022, Monero underwent a hard fork, i.e. a protocol upgrade that introduced several new features to improve user anonymity and performance. [5] EclecticIQ analysts assess that Bitcoin will remain the most popular currency used by cybercriminals [6], but that savvy criminals will switch to Monero and other Anonymity Enhanced Cryptocurrency (AEC). Due to its promise of privacy, the adaption of Monero for criminal activity has been growing in past years. [7, 8, 9]. More threat actors beginning to understand that BTC transactions are more transparent and easier to trace than Monero and other AEC. Yet, countries have banned Monero [10] and many exchanges have delisted it [11, 12], limiting its liquidity, and thus holding it back in terms of value. Furthermore, recent sanctioning of Tornado Cash [13] by the U.S. Treasury Department has created uncertainty and fear in the Monero community that the U.S. government could shut down Monero too.[14]

Monero is considered an Anonymity Enhanced Cryptocurrency as it uses Ring Signatures, Ring Confidential Transactions, and Stealth Addresses to conceal and keep a user’s identity anonymous. Ring Confidential Transaction (RingCT) is a technology that encrypts the transaction amount. Only the sender and receiver know the transaction amount.

Ring signature is a technology to protect a user’s privacy in the input side of a transaction, masking sender and the origin of a transaction. To prevent transactions from being linked to the sender, Monero merges the transaction signature of a user with those of other users to create ambiguity in blockchain analysis and make trace-back challenging. In its latest fork, Monero increased the ring size from 11 to 16, meaning more keys are required to complete a transaction ring improving the anonymity sets.

Stealth addresses prevent transactions from being linked to the recipient’s public wallet address. In Monero, senders are required to create random one-time addresses for every transaction on behalf of the recipient. This means, no one can know which wallets were used to send and receive money.

The fork also introduced performance upgrades and critical security patches. Monero’s value rose by nearly 6.5% after the community applied a new hard fork to the blockchain. [15]

Threat Actor Updates: LockBit Accuses Entrust of DDoS Attack; If Proven Would Set a New Precedent

LockBit operators accused Entrust of conducting a Denial-of-Service attack against its Tor leak sites, after the group started publishing stolen Entrust data on August 19th. [1]

EclecticIQ analysts note that there is no evidence that Entrust or an affiliated cybersecurity company conducted the attacks and assess its likelihood to be low. Analysts argue that cybersecurity specialists would know that a DDoS attack would only have limited and temporary impact on cybercriminal operations. It would not prevent the release of stolen data. As seen in the current case, LockBit operators “plan to upload all of Entrust’s data as a torrent, which will make it almost impossible to take down.” [2] Analysts highlight that a ransomware victim, or cybersecurity firm conducting a DDoS attack (or any other form of offensive actions) would set an unprecedented case and would indicate a paradigm shift.

LockBit operators have claimed responsibility for a ransomware attack on digital security company Entrust that occurred in June 18th, 2022. [3] According to OSINT, the criminals set a deadline for the ransom payment ($8 Million) of August 19th. Chat logs reveal that the ransom dropped to $6,8M. Following failed negotiations, the group started publishing the stolen data on their LockBit ransomware Tor blog on August 19th. [4]

Shortly after the release, the group claimed that it suffered a Denial-of-Service attack against their Tor leak sites. The group posted HTTP logs with messages in the user agent field to delete Entrust’s data. At the time of the reporting, LockBit´s blog mirrors were still inaccessible.

Key Infrastructure and Critical Vulnerabilities: Seven Vulnerabilities Added to CISA Known Exploited Vulnerabilities Catalog

On August 18th, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its list of actively exploited vulnerabilities [16]. EclecticIQ strongly recommends patching the vulnerabilities as per vendor instructions, and to incorporate the Known Exploited Vulnerabilities Catalog in its patch management plan for prioritization. The following CVEs have been added [17]:

CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
CVE-2022-21971 Microsoft Windows Runtime Remote Code Execution Vulnerability
CVE-2022-26923 Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
CVE-2022-2856 Google Chrome Intents Insufficient Input Validation Vulnerability
CVE-2022-32893 Apple iOS and macOS Out-of-Bounds Write Vulnerability
CVE-2022-32894 Apple iOS and macOS Out-of-Bounds Write Vulnerability
CVE-2022-22536 SAP Multiple Products HTTP Request Smuggling Vulnerability

Except for CVE-2017-15944, no details are available yet about how the vulnerability is being exploited.

About EclecticIQ Threat Research

EclecticIQ is a global provider of threat intelligence, hunting and response technology and services. Headquartered in Amsterdam, the EclecticIQ Threat Research team is made up of experts from Europe and the U.S. with decades of experience in cyber security and intelligence in industry and government.

We would love to hear from you. Please send us your feedback by emailing us at [email protected]ticiq.com or fill in the EclecticIQ Audience Interest Survey to drive our research towards your priority area.