UnknownPublished 18 Nov 2025

XCTDH Crypto Heist Part 3 · Yashraj Solanki

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

XCTDH Crypto Heist Part 3 - Yashraj Solanki

Impact

For European organizations, especially those operating cryptocurrency exchanges, blockchain infrastructure, or financial services dealing with digital assets, this threat could result in significant financial losses if successful thefts occur. The medium severity suggests that while the threat is credible, it may not currently be actively exploited or widespread. However, given the strategic importance of cryptocurrency in global finance and the known targeting of crypto assets by North Korean actors, European entities could face risks including theft of digital assets, disruption of services, and reputational damage. The impact extends to regulatory compliance challenges, as stolen crypto assets may be used in money laundering or sanctions evasion. The threat also underscores the need for enhanced cyber threat intelligence sharing and collaboration across European financial sectors to detect and respond to such activities promptly.

Defensive guidance

European organizations should implement advanced monitoring of cryptocurrency transactions and wallet activities to detect anomalous behavior indicative of theft attempts. Employ multi-factor authentication and hardware security modules (HSMs) for managing private keys to reduce the risk of unauthorized access. Regularly update and audit blockchain-related infrastructure and smart contracts to identify potential security gaps. Engage in active threat intelligence sharing with national cybersecurity centers and industry groups to stay informed about emerging tactics used by DPRK threat actors. Conduct employee training focused on social engineering and phishing risks that could facilitate initial access. Implement network segmentation and strict access controls around crypto asset management systems. Consider deploying blockchain analytics tools to trace suspicious transactions and collaborate with law enforcement agencies for incident response. Given the lack of patches, focus on preventive controls and detection capabilities rather than remediation of specific vulnerabilities.

Indicators of compromise

IP addresses 84

23.26.237.237
23.26.237.117
23.27.24.90
23.27.168.222
136.0.141.91
136.0.141.245
166.88.117.240
23.27.124.91
156.227.0.60
96.126.191.167

Hashes 25

742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20
a7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3
236ff897dee7d21319482cd67815bd22391523e37e0452fa230813b30884a86f
742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20
a7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3
24cad593f02db847d1302ee7c486d0756708521d5ae69faa9d6600dff81fd924
a51c2b2c5134d8079f11a22bd0621d29b10e16aefa4174b516e00fa40dafde69
be21bf4ad94c394202e7b52a1b461ed868200f0f03b3c8544984e9765c23e1e0
87330f64f5cd4695f2385f87c9ffffee26d5ad2637665f1cd5d7fce217770a4d
ba738d8fa5ecd4b996612dde6cd4516cbe7116305661521ffcfd62d37687875d

Datetime 88

2025-11-18T00:00:00+00:00
2025-10-18T00:00:00+00:00
2025-10-18T00:00:00+00:00
2025-10-18T00:00:00+00:00
2025-09-18T00:00:00+00:00
2025-09-18T00:00:00+00:00
2025-09-18T00:00:00+00:00
2025-09-18T00:00:00+00:00
2025-09-18T00:00:00+00:00
2025-09-18T00:00:00+00:00

Text 117

Rhadamanthys Stealer
Rhadamanthys Stealer
Sliver C2
Rhadamanthys Stealer
Rhadamanthys Stealer
Rhadamanthys Stealer
Remcos
Remcos
Rhadamanthys Stealer
Xworm

File 25

Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25
Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25
Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25

Counter 2

Community reviews

Loading reviews…