In a report shared by “ClearSky” digital security company in cooperation with “ZDNetYesterday, it was reported that a group of hackers believed to be operating in an organized manner stole about $200 million from cryptocurrency exchanges.

Mr. Or Platt, Head of the ClearSky Research Team, stated that the group that ClearSky belongs to under the name “CryptoCore” has been active since 2018.

Platt added that they linked CryptoCore to five successful hacks, but they also saw that the group also targeted 10 to 20 trading platforms.

Tell Platt Source In an email yesterday, the five confirmed victims are in the United States, Japan and the Middle East without revealing the names of the victims due to non-disclosure agreements.

Read:BlackRock Launches Crypto ETF In Europe Amid Regulatory Concerns

According to ClearSky, some CryptoCore operations were previously documented in isolated reports identifying them as dangerous, and security firm ClearSky says the group’s operations were more extensive and pervasive than previously documented.

Same way of working for the past three years

Although the operation lasted about two and a half years, ClearSky says the group has been using the same tactics throughout this time, with little difference in their attacks.

ClearSky says that all attacks begin with the information gathering stage, during which the necessary details are collected to target the exchange’s management, the platform’s IT staff, and other employees.

The first phishing attacks are always launched against personal email accounts, rather than corporate accounts, which are likely to be less secure than official accounts and will sometimes contain commercial information.

Then CryptoCore operators will eventually move on to targeting business accounts as well.

What was stated in the “ClearSky” report is the following:

It takes hours to weeks for the phishing email to be sent to the trading platform executives’ email account.

The cybersecurity company added with clarification:

Read:Approval of an ETF “Valkyrie Capital” that tracks companies that use clean energy in mining

Phishing is usually done by impersonating a high-ranking employee either from the target organization or from another organization (such as an advisory board) with connections to the target employee.

The ultimate goal is to plant malware on the employee or manager’s computer and steal or gain access to the password manager’s account.

Read:Project “Aave” launches “Lens” decentralized protocol for social media

CryptoCore hackers use these passwords to access accounts and wallets, disable two-factor authentication systems, and initiate transfers of funds from exchanges’ “hot wallets” to their own wallets.

CryptoCore is now the second group and organization that has repeatedly targeted cryptocurrency exchanges over the past 3-4 years.

North Korean state-sponsored hackers have been the biggest threat to crypto exchanges.

According to a report by the United Nations Commission on Intelligence, North Korean hackers stole about $571 million from at least five trading platforms in Asia between January 2017 and September 2018.

Read also:

Trading platform balances drop by $3 billion since mid-March… What does this mean?

Hacking a decentralized trading platform and stealing 250 thousand dollars