The accomplishment could be a major coup for the attackers. Both Chainalysis and public sources have revealed a long list of high-profile customers, including government agencies such as the FBI, US Immigration and Customs Enforcement agency, and the US Air Force, as well as private companies such as Microsoft, Coinbase, and Barclays. It’s unclear if the data theft exposed customers to additional threats.
We regret to inform you…
Last Friday, Chainalysis said it had been the target of a cybersecurity incident in October that was similar to the hacks of other platforms during the same month. The external actor used AI agent-assisted offensive techniques to gain unauthorized access to Chainalysis systems and internal tools. An email the company sent to affected customers said some “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.” It’s not clear why the company considered such information “non-sensitive.”
In a Wednesday update, the company said that part of the “ongoing multifront cyberattack” involved an “on-path attack” that exposed a subset of customer passwords, and that the attack vector had been identified and fixed. Also known as an adversary-in-the-middle attack, on-path attacks happen when a hacker gains access to a piece of infrastructure sending traffic back and forth between two parties. Chainalysis has yet to say where the infrastructure compromise occurred and if the data obtained from it was TLS encrypted.
The company said later that day that an investigation two days earlier (on Monday) had revealed that “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” It also said it had detected “abnormal activity” and, in response, took down its login page and know-your-transaction service, which monitors threats to cryptocurrency holdings in real time. The company has also removed access to its Reactor and Data Solutions services.
In an update on Friday, Chainalysis said it had begun phasing in customer access to KYT and Address Screening and expected more customers to follow. It asked customers to submit their trusted IP addresses so they can be added to an allow list and to prepare to reset credentials once they regain access. The credential rotation is mandatory.
The company says its investigation has yet to reveal any evidence that any investigation data has been accessed or Chainalysis attribution data has been manipulated.
Several important questions remain unanswered. As noted, the source that made the on-path attack possible is still unknown. It’s not clear how useful the information obtained in such an attack would be unless the attackers also had the ability to decrypt the traffic they were monitoring. If that were the case, the attackers might have gained broad control of the company’s infrastructure.
Chainalysis also didn’t explain why it waited until Wednesday to disclose the data theft of all customers’ personal information when its investigation discovered the exposure two days earlier. Further, the company has provided no details about the AI agents used in the attack and how they worked.
A Chainalysis representative said the company wasn’t commenting beyond the statements in its blog post.
Source: Iwpost.com
