Dutch cybersecurity experts have uncovered a significant cryptocurrency theft linked to the notorious Ebury botnet, which has compromised over 400,000 servers spanning a 15-year period.

The revelation came to light during a 2021 investigation conducted by the Dutch National High Tech Crime Unit (NHTCU). It was during this investigation that authorities discovered the presence of the Ebury botnet on a server associated with crypto theft operations.

Following this discovery, the Dutch crime unit teamed up with ESET, a Slovakian cybersecurity firm led by researcher Marc-Etienne Léveillé, who had been monitoring Ebury for more than a decade.

The operators of Ebury employed a sophisticated attack technique known as adversary-in-the-middle (AitM) to pilfer cryptocurrency funds. This method involves the botnet intercepting network traffic, capturing login credentials, and session information.

Surprisingly, cryptocurrency theft was a new venture for Ebury operators, as noted by Léveillé.

The botnet redirected this intercepted traffic to servers controlled by cybercriminals, enabling them to access and steal cryptocurrency from victims' wallets. According to ESET's report, over 100,000 systems remained infected as of 2023.

Ebury primarily targeted Bitcoin and Ethereum nodes, extracting wallets and valuable credentials from unsuspecting victims. The theft occurred once victims entered their credentials on the compromised server.

Furthermore, once a system was compromised, Ebury would exploit the stolen credentials to infiltrate related systems. Victims ranged from universities and enterprises to internet service providers and cryptocurrency traders.

The attackers also utilized stolen identities to rent servers and execute their attacks, making it challenging for law enforcement to trace their identities.

Although one Ebury operator, Maxim Senakh, was apprehended at the Finland-Russia border in 2015 and extradited to the United States, many perpetrators remain at large. Despite this, the NHTCU has disclosed that several leads are being pursued.

Crypto theft continues to evolve in complexity. Recently, North Korean hackers employed a new malware variant called "Durian" in targeted attacks on cryptocurrency firms. Earlier in January, a report by cybersecurity firm Kaspersky revealed malware targeting cryptocurrency wallets on MacOS.

As cybercriminals become increasingly sophisticated, collaborations between law enforcement agencies and cybersecurity firms are crucial in combating such threats.