[S3xySmurf]

Fortinet or more specifically Floser Bacurio and Joie Salvio have uncovered a little hacking spree targeting Bitcoin investors.

It comes in the form of an email masquerading as bitcointalk.org and uses a simple but effective .vbs script which contains what looks like a jpeg but is really disguised PE file which turns out to be a backdoored version of TTJ- Inventory System, first look at the decompiled source shows that it unpacks another bit of data and using hardcoded keys unpacks it and runs it directly in memory.

It's a pretty horrible way to spread because to me it's so dirty but non the less it's obviously doing the job its supposed too.

See the full post here https://blog.fortinet.com/2017/12/07/a-p...-investors

hxxps://bltcointalk.com/ here's the URL they are using, can you spot the difference?

[mothered]

Seems very Impressive.

The article Is quite In depth, so I've bookmarked It for later analysis.

hxxps://bltcointalk.com/ here's the URL they are using, can you spot the difference?

Spoiler:

bltcointalk.com = b(L)tcointalk.com