An unknown threat actors using the malicious exit nodes to the Tor network for over a year (more than 16 months) simply to intercept the traffic and carry out SSL-stripping attacks on the users who are visiting the websites related to the cryptocurrency.
Now many of you might be thinking that what is SSL-stripping? It is a method through which the attackers downgrade a connection from secure HTTPS to plain HTTP.
Here the attacks became known back in August 2020, all thanks to a security researcher known as “Nusenu,” who is also the operator of the Tor exit node.
.png
)
At the time, it was reported that the attacks began in January last year, and at the height of the operation, the attackers controlled approximately four hundred malicious Tor exit nodes.
New Complicated Attack
However, according to the report that summited by Nusenu over Medium, during the attacks, the attackers changed the addresses of cryptocurrency wallets with their own to intercept transactions.
Despite the reporting last year, the threat actors are still operating their attacks. As in February 2021, attacks hit 27% of malicious Tor exit nodes, although the second wave of attacks was noticed and neutralized.
But, after the malicious infrastructure had been active for several weeks. The main reason for the success of this operation is that the attackers added malicious nodes in small numbers, quietly creating an impressive infrastructure.
Apart from this, since May Nusenu has been reporting the malicious exit relays to the admins of the Tor network. Even he also claimed that the capabilities of the attackers have been decreased dramatically just after the latest takedown that took place on June 21.
In early May, the attackers tried to simultaneously return back online all the disconnected servers, that couldn’t go unnoticed. Here, the attack was discovered just a day after the number of Tor exit nodes skyrocketed from 1500 to more than 2500.
So, instead of shutting down over 1,000 malicious servers, still the attackers have 4-6% of Tor’s power output under their control. Moreover, Nusenu noted that, after the SSL-stripping attack, the attackers download modifications, but what they exactly do is still not clear.
In 2018, a Similar Attack Took Place
The cybersecurity specialists claimed that in 2018 a similar type of attack took place, but at that time Tor exit nodes were not targeted. Instead of Tor nodes, the attackers targeted the Tor-to-web (Tor2Web) proxies.
Moreover, the Tor-to-web (Tor2Web) proxies are the public websites that allow normal users to access the .onion websites that are only accessible through the Tor Browser.
During this operation, Proofpoint, a US security firm who reported that an unknown operator of the Tor-to-web proxy has been replacing the Bitcoin addresses for the users silently who are seeking to pay the ransom demands on the ransomware payment portals.
As a result, the threat actors who are in the middle are silently looting the ransom payments of the users, and leaving them aside without a decryption key, even after paying the ransom amount.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates
