Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Summary

Operation ASTERIX is a sophisticated cryptocurrency fraud campaign built around a multi-stage pipeline combining social engineering, vishing, and counterfeit wallet applications. The attackers use AI coding assistants to develop, obfuscate, and package malware, while also attempting to jailbreak LLM safety controls. The operation primarily aims to steal BIP39 recovery phrases from users of legitimate cryptocurrency wallets.

Investigation

Rapid7 researchers discovered an exposed web directory within the attackers’ infrastructure, offering rare insight into their development environment. The exposure revealed raw phone datasets, phishing panels, AI-generated code, and specific jailbreak prompts used to circumvent LLM safety mechanisms. Investigators reconstructed the full kill chain from initial reconnaissance through credential theft and final exfiltration over Telegram.

Mitigation

Users should verify cryptocurrency wallet applications through official developer channels and avoid installing software from unofficial documentation or download sites. Organizations should monitor for suspicious macOS LaunchAgents and unauthorized Windows registry modifications. Security teams should also scrutinize phishing emails that coincide with unexpected phone calls or other vishing activity.

Response

If counterfeit wallet processes or suspicious LaunchAgents are detected, the affected host should be isolated immediately. Responders should terminate unauthorized Electron-based processes and monitor outbound connections to known Telegram API endpoints. All cryptocurrency wallet credentials and recovery information accessed from the compromised system should be considered exposed and rotated where possible.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has deployed a malicious Node.js script disguised as a monitoring utility for the Trezor Suite. The attacker’s goal is to identify if a legitimate Trezor process is running to target high-value crypto-wallet users. The script, trezor-monitor.js, is executed via the Node.js interpreter. To match the specific signature of the known malware, the script is called with the exact argument "process list scanning". This creates a process creation event where the image path ends in trezor-monitor.js and the command line contains the trigger string.

• Regression Test Script:

  # Create a dummy directory to simulate a software installation path
  $fakeDir = "$env:TEMPTrezorSuiteMock"
  New-Item -ItemType Directory -Path $fakeDir -Force
  
  # Create the malicious JS file
  $scriptContent = "console.log('Scanning for processes...');"
  $scriptPath = Join-Path $fakeDir "trezor-monitor.js"
  Set-Content -Path $scriptPath -Value $scriptContent
  
  # Execute the script using node.exe with the specific command line required by the rule
  # Note: This assumes node.exe is in the system PATH.
  Start-Process "node.exe" -ArgumentList "`"$scriptPath`" process list scanning" -Wait
  
  Write-Host "Simulation complete. Check SIEM for detection."

• Cleanup Commands:

  # Remove the dummy directory and script
  Remove-Item -Path "$env:TEMPTrezorSuiteMock" -Recurse -Force