Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

XCTDH Crypto Heist Part 3 - Yashraj Solanki

0
Medium
Published: Tue Nov 18 2025 (11/18/2025, 00:00:00 UTC)
Source: CIRCL OSINT Feed
Vendor/Project: type
Product: osint

Description

XCTDH Crypto Heist Part 3 - Yashraj Solanki

AI-Powered Analysis

AILast updated: 11/18/2025, 14:40:09 UTC

Technical Analysis

The XCTDH Crypto Heist Part 3 report appears to be part of a series of intelligence findings related to North Korean cyber operations targeting cryptocurrency assets. The source is the CIRCL OSINT Feed, indicating that the information is derived from open-source intelligence rather than confirmed technical exploits or vulnerabilities. The report lacks detailed technical indicators, affected software versions, or specific attack vectors, which limits the ability to perform a deep technical analysis. The medium severity rating suggests a moderate risk level, likely due to the association with North Korean threat actors known for sophisticated cybercrime and state-sponsored operations. The absence of patches or known exploits in the wild indicates that this is more of an intelligence alert than an active vulnerability or exploit campaign. The mention of DPRK (North Korea) and the crypto heist context aligns with historical patterns where North Korean groups have targeted cryptocurrency exchanges and wallets to circumvent sanctions and generate revenue. The uncertainty (50% certainty) and lack of detailed indicators imply that organizations should treat this as a potential emerging threat rather than an immediate crisis. The report's perpetual lifetime tag suggests ongoing monitoring is advised. Overall, this intelligence highlights the continued interest of North Korean actors in cryptocurrency theft, emphasizing the need for vigilance in crypto-related sectors.

Potential Impact

For European organizations, the primary impact of this threat lies in the potential financial losses and reputational damage resulting from cryptocurrency theft. Entities such as cryptocurrency exchanges, wallet providers, blockchain infrastructure companies, and financial institutions facilitating crypto transactions are at heightened risk. A successful heist could lead to significant monetary loss, disruption of services, and erosion of customer trust. Additionally, regulatory repercussions could arise if organizations fail to adequately protect assets or report incidents. Given Europe's increasing adoption of cryptocurrencies and the presence of major crypto hubs in countries like Germany, the Netherlands, and the UK, the threat could affect critical financial infrastructure. The medium severity reflects that while the threat is credible, the lack of active exploits or detailed attack methods reduces immediate risk. However, the persistent nature of North Korean cybercrime campaigns means that organizations should remain alert to evolving tactics that could impact confidentiality, integrity, and availability of crypto assets.

Mitigation Recommendations

European organizations should implement targeted measures to mitigate risks associated with North Korean crypto theft campaigns. These include: 1) Enhancing monitoring and anomaly detection for cryptocurrency transactions to identify suspicious activities early. 2) Employing multi-factor authentication and hardware security modules (HSMs) for wallet and key management to prevent unauthorized access. 3) Conducting regular threat intelligence sharing with industry groups and national cybersecurity centers to stay informed about emerging tactics linked to DPRK actors. 4) Implementing strict access controls and network segmentation for systems handling crypto assets to limit lateral movement. 5) Performing continuous security assessments and penetration testing focused on crypto infrastructure. 6) Training staff on social engineering and phishing risks, as these are common initial attack vectors. 7) Establishing incident response plans specifically for crypto-related breaches, including coordination with law enforcement and regulatory bodies. 8) Considering the use of blockchain analytics tools to trace and block illicit transactions linked to known North Korean wallets. These steps go beyond generic advice by focusing on the unique challenges posed by state-sponsored crypto theft operations.

Need more detailed analysis?Get Pro

Technical Details

Uuid
fbf8c6e8-5e74-493f-9699-ec352bcc179c
Original Timestamp
1763467869

Indicators of Compromise

Ip

ValueDescriptionCopy
ip23.26.237.237
ip23.26.237.117
ip23.27.24.90
ip23.27.168.222
ip136.0.141.91
ip136.0.141.245
ip166.88.117.240
ip23.27.124.91
ip156.227.0.60
ip96.126.191.167
ip108.165.147.181
ip216.173.65.45
ip166.88.194.123
ip23.27.163.245
ip23.27.169.64
ip23.27.24.227
ip166.88.132.69
ip166.0.132.184
ip38.211.230.55
ip23.27.201.30
ip166.88.61.58
ip166.88.114.78
ip166.88.100.85
ip23.27.48.77
ip166.88.95.137
ip23.27.48.113
ip166.88.14.137
ip216.173.64.63
ip166.88.90.22
ip23.27.169.4
ip166.88.98.221
ip23.27.240.252
ip23.27.48.179
ip166.88.141.40
ip23.27.48.4
ip23.27.12.214
ip23.27.201.57
ip156.235.89.227
ip23.27.240.237
ip45.194.27.99
ip166.88.57.117
ip136.0.11.193
ip23.27.244.39
ip172.121.5.230
ip166.88.132.139
ip166.88.97.138
ip166.88.61.35
ip166.88.96.120
ip166.88.4.2
ip166.88.2.90
ip166.88.194.53
ip166.88.61.53
ip166.88.117.11
ip166.88.35.203
ip166.88.2.184
ip166.88.14.52
ip166.88.14.44
ip166.88.101.20
ip166.88.99.15
ip166.88.55.54
ip166.88.132.39
ip166.88.159.187
ip166.88.159.37
ip193.57.57.121
ip198.105.127.98
ip198.105.127.124
ip223.165.6.30
ip38.211.230.5
ip38.246.73.120
ip45.195.76.82
ip45.195.76.26
ip50.114.5.82
ip91.218.183.90
ip103.179.142.121
ip136.0.3.250
ip136.0.3.71
ip136.0.3.240
ip136.0.8.169
ip136.0.9.8
ip142.111.77.196
ip154.81.220.233
ip155.254.60.160
ip156.227.0.187
ip156.236.76.90

Datetime

ValueDescriptionCopy
datetime2025-11-18T00:00:00+00:00
datetime2025-10-18T00:00:00+00:00
datetime2025-10-18T00:00:00+00:00
datetime2025-10-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-09-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2025-05-18T00:00:00+00:00
datetime2025-05-18T00:00:00+00:00
datetime2025-05-18T00:00:00+00:00
datetime2025-05-18T00:00:00+00:00
datetime2025-04-18T00:00:00+00:00
datetime2025-04-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-01-18T00:00:00+00:00
datetime2024-12-18T00:00:00+00:00
datetime2024-12-18T00:00:00+00:00
datetime2024-12-18T00:00:00+00:00
datetime2024-12-18T00:00:00+00:00
datetime2024-10-18T00:00:00+00:00
datetime2024-09-18T00:00:00+00:00
datetime2024-09-18T00:00:00+00:00
datetime2024-08-18T00:00:00+00:00
datetime2024-04-18T00:00:00+00:00
datetime2024-02-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-07-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2025-08-18T00:00:00+00:00
datetime2025-04-18T00:00:00+00:00
datetime2025-04-18T00:00:00+00:00
datetime2025-04-18T00:00:00+00:00
datetime2025-03-18T00:00:00+00:00
datetime2025-03-18T00:00:00+00:00
datetime2024-12-18T00:00:00+00:00
datetime2025-03-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-11-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2024-10-18T00:00:00+00:00
datetime2025-01-18T00:00:00+00:00
datetime2024-05-18T00:00:00+00:00
datetime2025-05-18T00:00:00+00:00
datetime2024-07-18T00:00:00+00:00
datetime2025-07-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2024-02-18T00:00:00+00:00
datetime2023-12-18T00:00:00+00:00
datetime2024-09-18T00:00:00+00:00
datetime2023-04-18T00:00:00+00:00
datetime2023-06-18T00:00:00+00:00
datetime2025-01-18T00:00:00+00:00
datetime2024-03-18T00:00:00+00:00
datetime2024-01-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2024-07-18T00:00:00+00:00
datetime2025-02-18T00:00:00+00:00
datetime2025-05-18T00:00:00+00:00
datetime2024-04-18T00:00:00+00:00
datetime2025-06-18T00:00:00+00:00
datetime2024-10-03T05:21:55+00:00
datetime2024-10-03T05:21:55+00:00
datetime2024-10-03T05:59:28+00:00
datetime2024-10-03T05:59:28+00:00

Text

ValueDescriptionCopy
textRhadamanthys Stealer
textRhadamanthys Stealer
textSliver C2
textRhadamanthys Stealer
textRhadamanthys Stealer
textRhadamanthys Stealer
textRemcos
textRemcos
textRhadamanthys Stealer
textXworm
textSuperShell C2
textRemcos
textCobalt Strike (Watermark: 0)
textVenomRAT
textDCRAT
textGoPhish
textRemcos
textSliver C2
textRemcos
textSliver C2
textAdaptixC2
textSliver C2
textCobalt Strike (Watermark: 391144938)
textRemcos
textMythic C2
textRed Guard (C2 Redirector)
textCobalt Strike (Watermark: 391144938)
textXWorm
textAsyncRAT
textViper C2
textCobalt Strike (Watermark: 0)
textCobalt Strike (Watermark: 666666666)
textCobalt Strike (Watermark: 666666666)
textCobalt Strike (Watermark: 666666666)
textCobalt Strike (Watermark: 987654321)
textSuperShell C2
textUNAM C2 Panel
textSliver C2
textCobalt Strike
textSliver C2
textSuperShell C2
textCobalt Strike (Watermark: 100000)
textRemcos
textCobalt Strike (Watermark: 100000)
textQuasarRAT
textPlugX
textChina Aligned Espionage - Cobalt Strike (Watermark: 100000)
textCobalt Strike (Watermark: 100000)
textNPM Supply Chain
textDark Peony (Operation Controlplug)
textEarth Kurma
textRussian Infra with DPRK
textDark Peony (Operation Controlplug)
textDark Peony (Operation Controlplug)
textCobalt Strike (Watermark: 666666666)
textCobalt Strike (Watermark: 987654321)
textXworm
textDeimosC2
textCobalt Strike (Watermark: Unknown)
textCobalt Strike (Watermark: Unknown)
textDPRK Lazarus - Contagious Interview
textFIN7
textFIN7
textCobalt Strike (Watermark: 100000)
textDPRK Lazarus (through domain resolution)
textPoC Exploit for Critical Zero Day
textVenomRAT
textDark Peony (Operation Controlplug)
textDark Peony (Operation Controlplug)
textCobalt Strike (Watermark: 100000)
textShadowPad
textSupershell
textCobalt Strike - Threat Actor: QUARTERRIG (APT29)
textAveMaria
textAsyncRAT
textBianlian
textBianlian
textDanabot
textNPM Supply Chain (Ports: 27017 and 3306)
textDPRK Moonsleet NPM
textRedline Stealer
textViciousTrap CVE exploitation
textAgent Tesla Targeting Entities
textPoC Exploit for Critical Zero Day
textDPRK APT - Python Stealer
textDPRK APT - Python Stealer
textDPRK APT - Python Stealer
textDPRK APT - Python Stealer
textDPRK APT - Python Stealer
textDPRK APT - Python Stealer
textDPRK APT - Python Stealer
textDPRK APT - JavaScript Loader
textDPRK APT - JavaScript Loader
textDPRK APT - JavaScript Loader
textDPRK APT - JavaScript Loader
textDPRK APT - JavaScript Loader
textDPRK APT - JavaScript Loader
textDPRK APT - JavaScript RAT
textDPRK APT - JavaScript RAT
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
textDPRK APT - Malware Indicators
texthttps://www.circl.lu/pdns/
textA
text166.88.159.37
text756984.xyz
texthttps://www.circl.lu/pdns/
textA
text166.88.159.37
textwww.756984.xyz

Hash

ValueDescriptionCopy
hash742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20
hasha7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3
hash236ff897dee7d21319482cd67815bd22391523e37e0452fa230813b30884a86f
hash742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20
hasha7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3
hash24cad593f02db847d1302ee7c486d0756708521d5ae69faa9d6600dff81fd924
hasha51c2b2c5134d8079f11a22bd0621d29b10e16aefa4174b516e00fa40dafde69
hashbe21bf4ad94c394202e7b52a1b461ed868200f0f03b3c8544984e9765c23e1e0
hash87330f64f5cd4695f2385f87c9ffffee26d5ad2637665f1cd5d7fce217770a4d
hashba738d8fa5ecd4b996612dde6cd4516cbe7116305661521ffcfd62d37687875d
hash83a84588a941e463c981083555a2e7814887fa8816e7cca5af9cb7fd0b62cdac
hash6e48fe09117ead1ef2c10a3db614217184fc300ac70ee902f67510b8d0d0b0c8
hash897d040e5db47b806c01eb2a1a056ca49b10e0aa4985f84d2b808a121083570e
hasheefe39fe88e75b37babb37c7379d1ec61b187a9677ee5d0c867d13ccb0e31e30
hash43dc7a343649a7ce748e4c2f94bcb6064199507cfd9f064a2d462536bec1d57f
hash908696f3ec522e846575061e90747ddf29fccab0e59364597493d72159986c60
hash897d040e5db47b806c01eb2a1a056ca49b10e0aa4985f84d2b808a121083570e
hashbe21bf4ad94c394202e7b52a1b461ed868200f0f03b3c8544984e9765c23e1e0
hash6e48fe09117ead1ef2c10a3db614217184fc300ac70ee902f67510b8d0d0b0c8
hash87330f64f5cd4695f2385f87c9ffffee26d5ad2637665f1cd5d7fce217770a4d
hash83a84588a941e463c981083555a2e7814887fa8816e7cca5af9cb7fd0b62cdac
hashba738d8fa5ecd4b996612dde6cd4516cbe7116305661521ffcfd62d37687875d
hasha2880c2d262b4a76e64fd29a813f2446ecbd640f378714aa575bf1064b7adc29
hash973f777723d315e0bee0fb9e81e943bb3440be7d2de7bf582419ae47479bc15d
hasha7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3

File

ValueDescriptionCopy
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_RAT_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Script_JS_RAT_Unknown_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25
fileActor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25

Counter

ValueDescriptionCopy
counter1
counter1

Threat ID: 691c8529b718280d689345ee

Added to database: 11/18/2025, 2:39:37 PM

Last enriched: 11/18/2025, 2:40:09 PM

Last updated: 11/19/2025, 3:55:47 AM

Views: 8

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats