lastpass

Сообщение ChainCatcher, инструмент управления паролями LastPass объявил, что его платформа рыночной разведки третьих сторон Klue подверглась инциденту безопасности, в результате которого хакеры украли несколько OAuth-токенов клиентов, принадлежащих Klue (включая LastPass), и использовали эти токены для доступа к системе CRM Salesforce LastPass, что привело к возможной утечке бизнес-контактной информации и данных CRM, таких как имена клиентов, номера телефонов, адреса электронной почты, домашние адреса и случаи поддержки.Официальное предупреждение: продукты, услуги, инфраструктура LastPass и хранилища паролей клиентов (vaults) не пострадали, данные системы Gong также не были доступны. LastPass немедленно принял меры, включая прекращение доступа сотрудников к Klue, ротацию скомпрометированных API-токенов, проведение детального расследования и сотрудничество с Klue, Salesforce и правоохранительными органами, а также обмен угрозами с сообществом безопасности через команду TIME и усиление защиты в будущем. Пользователи должны быть бдительными и остерегаться возможных фишинговых писем, звонков или атак социальной инженерии, которые могут использовать утечку информации, и помнить, что LastPass никогда не будет запрашивать главный пароль, все официальные сообщения отправляются через надежные каналы.

According to Crowdfund Insider, TRM Labs stated that it has traced stolen crypto assets from the 2022 LastPass vulnerability incident on-chain, with on-chain indicators suggesting the involvement of Russian cybercrime groups in the laundering process.TRM noted that although hackers used mixing tools like CoinJoin, they were still able to associate the flow of funds before and after the mixing back to the same group of attackers through de-mixing and behavioral continuity analysis. The related funds ultimately flowed into high-risk Russian exchanges Cryptex and Audi6, with the total amount involved estimated to exceed $28 million.

ChainCatcher news, on-chain detective ZachXBT posted that the password manager LastPass was hacked in 2022, resulting in the theft of nine-figure cryptocurrency. The team has long been covering up the extent of the attack and has gaslighted many confirmed victims. Yesterday, in a forfeiture complaint, even law enforcement publicly agreed that LastPass may be liable for the stolen cryptocurrency.

ChainCatcher news, on-chain detective ZachXBT updates that the assets stolen by the LastPass attacker have risen to $12.38 million, coming from over 100 victim addresses.Previous news, on-chain analyst ZachXBT disclosed that the LastPass attacker targeted over 40 victim addresses, stealing approximately $5.36 million in crypto assets. The attacker then exchanged the stolen funds for ETH and attempted to cover the flow of funds by transferring assets across chains from the Ethereum network to the Bitcoin network through multiple instant exchanges.

ChainCatcher news, on-chain analyst ZachXBT revealed that the LastPass attackers targeted over 40 victim addresses, stealing approximately $5.36 million in crypto assets. The attackers then exchanged the stolen funds for ETH and attempted to obscure the flow of funds by transferring assets across chains from the Ethereum network to the Bitcoin network through multiple instant exchanges.

ChainCatcher news, according to on-chain detective ZachXBT's monitoring, on just one day, October 25, 2023, the LastPass hack resulted in over 25 victims losing approximately $4.4 million.If users believe they may have stored mnemonic phrases or keys in LastPass, please transfer your crypto assets immediately.

ChainCatcher message, a user flippen.eth posted on platform X that he stored his mnemonic phrase on the online password management platform LastPass, and overnight lost more than 20 Ethereum from his hot wallet. He stated: "This issue seems to be quite common; if you have ever used LastPass, pay attention to your passwords and abandon the wallet along with the mnemonic phrase stored there."