Ethersphere systems were compromised, leading to the release of malicious versions of bee-js (13.3.0) and Swarm Desktop (0.56.2).
The malware exfiltrates wallet keys and installs backdoors on Windows, macOS, and Linux.
On Windows, it exploits the ScreenConnect tool for persistence.
Swarm Desktop 0.56.3 is now available, but standard updates cannot remove the installed backdoor.
The recommended remediation is a complete system rebuild for all machines that ran the compromised versions.
Which versions are affected?
The problem was detected in the following versions:
- bee-js: 13.3.0 version
- Swarm Desktop: 0.56.2 version
The Ethersphere team has now retired version 0.56.2 of Swarm Desktop and replaced it with version 0.56.3.
What can the program do?
If you have installed any of the above versions, your computer is considered compromised. The infected software is designed to steal your digital wallet keys, as well as your unlock code. It also installs a backdoor that allows third parties to remotely control your device.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Spy group launches new attacks with unknown program
↗
On Windows computers, the attackers use a legitimate remote access tool (ScreenConnect) to hide their presence and manipulate the system. While no money has been confirmed stolen at the time of reporting, the risks to your data security are immediate.
How the breach occurred
The attackers gained access to Ethersphere's systems using stolen credentials from the development team itself, which allowed them to pass off the malware as an official and valid update.
What you have to do
It is very important to know that a simple software update does not remove the malware if it is already installed on your device.
Experts recommend the following steps:
- Full reset: The safest solution is to completely erase the contents of your computer and install it from scratch.
- Transfer of assets: If you had digital keys or wallets on your computer, consider them exposed. Transfer your funds to a new, secure wallet using another, clean device.
- Change codes: From another device that is not infected, change all passwords you had saved on the computer.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)