New Cryptocurrency Ransomware Could ‘Become Very Dangerous’, Researchers Warn

A newly discovered cryptocurrency ransomware strain called “Anatova” has the potential to “become very dangerous,” according to cybersecurity experts who revealed the strain is more advanced than others that have in the past launched successful campaigns.

Anatova, according to cybersecurity firm McAfee, hides in common files, usually those of popular games or applications, to fool potential victims. Once downloaded, it asks the victim for admin rights, and then proceeds to encrypt as many files as it can in a short amount of time, to then demand a Dash ransom.

As first reported by The Next Web, researchers have detected over 100 instances of Anatova in the US already, with various countries in Europe also being significantly affected.

Known cases of Anatova by region

Speaking to the news outlet Christiaan Beek, McAfee’s lead scientist, revealed Anatova has “the potential to become very dangerous with its modular architecture which means that new functionalities can easily be added.”

Specifically, Anatova is reportedly more sophisticated than Ryuk, a malware strain that is estimated to have collected over $3.7 million in bitcoin ransoms over a five-month period. The researchers believe the team behind Anatova is better than that of Ryuk, as it has a “more advanced design” that “tries to make analysis difficult.”

Per Christiaan, those behind Anatova “have embedded enough functionalities to be sure that typical methods to overcome ransomware will be ineffective.” This, by making sure data cannot be restored without the payment being made, and stopping generic decryption tools from being working on it.

Notably, Anatova is using Dash instead of other cryptocurrencies. While it isn’t the first ransomware strain to demand Dash instead of Bitcoin or Monero, demanding the privacy-centric cryptocurrency is uncommon.

Per Christiaan, there’s a reason:

The main reason [Antova is] using DASH is that it has implemented a number of privacy enhancing protocols that make tracing transactions difficult.

As The Next Web pointed out, the GandCrab ransomware family, first discovered early last year, was reportedly the first to demand Dash payments.

Liquidators Take Charge of Cryptopia: Here Are Cryptopia’s Big Mistakes

Phil Carroll is a Blockchain researcher and enthusiast who has been following the market for over 5 years now. He has been working as a freelance chain analyzer and as a technological content writer for whitepapers etc. In his spare time, he likes to write about topics that involve Bitcoin, Blockchain and cryptocurrencies.

Although cryptocurrencies themselves are incredibly secure, the exchanges that facilitate their movement have been far more problematic.

2018 set a record for the most crypto exchange hacks in history, and the efforts of bad actors are becoming more expansive and more expensive with time. Now, another crypto exchange has been brought down by a hack.

The Slow Descent of Cryptopia

The New Zealand-based Cryptopia endured a hack on January 14 that cost the company $16 million worth of digital assets including Ether and ERC-20 tokens. In the immediate aftermath of the breach, Cryptopia took its site offline posting a message indicating that the website was under maintenance.

At the same time, Cryptopia contacted police authorities who worked to identify the perpetrators and to attempt recovery of the stolen assets. A few days later, the company acknowledged the data breach and admitted that they incurred “significant losses.”

Eventually, Cryptopia came back online, providing trading limited trading opportunities while continuing to experience banking issues. This reduced functionality prevented many users from cashing out their tokens.

For a while it seemed as if it is going to recover from the hack. However, after making efforts to reduce costs and develop a profitable business model, Cryptopia decided that it was in the best interest of all stakeholders to liquidate the exchange. In a statement, Grant Thornton, Cryptopia’s assigned liquidator, conveyed their intention “to find the solution that is in the best interests of customers and stakeholders.”

Take Note of the Mistakes

In some ways, Cryptopia made many correct moves in attempting to repair their exchange after such a significant breach. However, the mistakes made prior to it were ones that can’t be overlooked.

Mistake #1 – Exchange Security

Obviously, whenever a crypto exchange is hacked, there is well-deserved scrutiny of its cybersecurity practices.

In this case, it’s speculated that the exchange stored users’ private keys, the most prominent line of defense again an intrusion, on a single server that was vulnerable to a hack. In this scenario, hackers could easily access and record users’ private keys and then delete the information, making it inaccessible to users and to the exchange.

It’s estimated that hackers gained access to 76,000 different wallets, and, according to analysis, “none of which were smart contracts“. Without access to their accounts, Cryptopia was powerless to stop hackers from draining funds from the exchange.

“What surprises me the most is the negligence in relation to the security of the entire chain of work with the exchange's wallets.” noted Serge Vasylchuk, CEO of CODEX Exchange. “It was possible to prevent a hack for Cryptopia if they would take three must-have measures seriously. First, to ensure maximum isolation from external influences and from accidental internal interference. Second, to backup private keys on a regular basis, on a well-protected physical copy”.

CODEX has been effusive in their security efforts. After deploying multi-stage security audit to ensure the integrity of their users’ accounts and funds, it received a 10/10 security rating from Hacken security team, CoinMarketCap's data accountability and transparency partner. It may be expensive, but it’s necessary for protecting digital assets, something that is critical in crypto markets.

To put it simply, the Cryptopia hack was predicated on lax security standards, and it could have been avoided or greatly diminished if the company embraced industry best practices for guarding user and company accounts.

Mistake #2 – Poor Community Transparency

Of course, technological oversights, while frustrating, are bound to happen from time to time. However, crypto exchanges have full control over their response. They decide their level of transparency and community investment, and their decisions in this regard can have cascading consequences.

Most notably, the company began by issuing a false statement to users. The website was not undergoing “unscheduled maintenance,” a misleading statement that is becoming a code for more problematic events.

While Cryptopia rightly contacted authorities to report criminal activity, the company’s updates were few and far between, leaving their users and the greater internet to speculate about the event and the state of their holdings.

Finally, when the exchange eventually relaunched, it was mostly unusable, appearing in a “read-only” format that prevented users from actually accessing the platform’s functionality.

Communication is always a choice, and exchanges that choose not to fully inform their userbase are doing them and the greater crypto community a disservice. “Of course, after such negligence it is difficult to tell users about the funds lost,” added Vasylchuk. “but the lack of timely communication only worsens the situation when there are people waiting for explanation.” 

Conclusion

Crypto exchanges are a crucial part of the digital currency ecosystem. Investors and traders need to be able to trust them and their ability to protect digital assets.

Cryptopia’s liquidation adds it to the list of exchanges that have misbehaved and have been punished for their actions.

Of course, it doesn’t have to be this way. Exchanges can learn from these mistakes. They can prioritize and enforce robust security standards while emphasizing transparency and communication throughout the process.

It’s the only way forward, and it’s one that exchanges need to learn now before they are the next ones making the news.