{
  "name": "Crypto Drainers as a Converging Threat: Insights into Emerging Hybrid Attack Ecosystems",
  "slug": "crypto-drainers-as-a-converging-threat-insights-into-emerging-hybrid-attack-ecosystems",
  "description": "Cybercriminals are merging traditional malware operations with cryptocurrency-focused attacks, creating hybrid threat ecosystems. Modern crypto drainers have evolved into automated systems capable of extracting assets across multiple blockchains with minimal user interaction, supported by well-developed underground marketplaces offering drainer-as-a-service kits. Two case studies exemplify this convergence: StepDrainer operates as a multichain drainer-as-a-service platform that abuses Web3Modal and smart contract methods across over 20 blockchain networks, using AI-themed lures and polished interfaces to deceive victims into connecting wallets. EtherRAT represents a hybrid Windows implant delivered through trojanized TFTP installers, combining traditional RAT capabilities with blockchain-aware functionality including Ethereum RPC endpoints and embedded wallet addresses. Both threats demonstrate how cryptocurrency theft infrastructure now intersects with mainstream attack surfaces affecting enterprise envir...",
  "published": "2026-04-23T19:25:57.783000+00:00",
  "created_at": "2026-04-27T14:41:26.858000+00:00",
  "modified_at": "2026-04-27T12:41:27+00:00",
  "created_at_opencti": "2026-04-27T14:41:26.858000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "cryptocurrency",
    "drainer-as-a-service",
    "etherrat",
    "miolab",
    "smart-contract-abuse",
    "stepdrainer",
    "wallet-phishing"
  ],
  "tags": [
    "2026-04-23",
    "cryptocurrency",
    "drainer-as-a-service",
    "etherrat",
    "miolab",
    "smart-contract-abuse",
    "stepdrainer",
    "wallet-phishing"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "8e563fd9-4fef-4e60-90ac-df485c35a117",
        "name": "eth-mainnet.public.blastapi.io"
      },
      {
        "id": "c920af6e-80b7-4109-ae79-5eb90a535d80",
        "name": "35e01440b9c63f17eb9e70096d2ec01d18309106a0d644db1110950d2d438e59"
      },
      {
        "id": "9b894dd3-ec90-46d9-b77f-44623727d699",
        "name": "mainnet.helius-rpc.com"
      },
      {
        "id": "fa2d30d1-f554-4982-a02f-cb5258903d53",
        "name": "c44d5c888647e78947fc93006d92e5521795ef31f7b0cae1ec829fec60d4bd7a"
      },
      {
        "id": "8459f998-8527-4115-9b39-681e6f61f596",
        "name": "rpc.flashbots.net"
      },
      {
        "id": "de7ce45e-2544-41f9-8386-3f92d9d12870",
        "name": "rpc.payload.de"
      },
      {
        "id": "8a49add1-2b74-48f8-b662-2cd497571fe0",
        "name": "ethereum-rpc.publicnode.com"
      },
      {
        "id": "d10f4319-16ab-46f2-9264-b0ee4b394ee9",
        "name": "b3e28c6a4fec257f4cdc63d93c84596c4c0ee67b839c0711e06d771dd5410b96"
      },
      {
        "id": "c5ab896c-c693-49f0-b336-2b2474190667",
        "name": "eth.drpc.org"
      },
      {
        "id": "966e7a14-6877-4c3c-837c-ef86194383f3",
        "name": "73b1d65c05da79b43f5dbddf4736d37b722a8fa6ea649d0ed5089b2bdb2c9e67"
      },
      {
        "id": "eb472190-3ce4-489f-b50f-9846961ef5c5",
        "name": "aahdjjsivunugynqjvyfbhqnjekniyfboma.com"
      },
      {
        "id": "df2ac3a9-3b48-40b7-8038-a790b11a80af",
        "name": "solana-mainnet.rpc.extrnode.com"
      },
      {
        "id": "d27aafa7-8769-4dab-a2a0-a108f0a25e42",
        "name": "scanclaw.live"
      },
      {
        "id": "a75b7bb3-7e1c-4f5f-b6e6-b4613610f42d",
        "name": "3188313f38e2114f5a9524bf812efaa7f70a89cd8ef2907b962cb1466251df70"
      },
      {
        "id": "cafcf2f5-49ff-4f86-bf51-60111d60134e",
        "name": "aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com"
      },
      {
        "id": "81a812eb-63ff-4fce-8ce3-b6632e98945a",
        "name": "http://moonscan.live/7w2NU3Z-.php"
      },
      {
        "id": "edc6e302-0fa2-4c7a-a7c6-413f2ed5138a",
        "name": "http://rpc.flashbots.net/fast"
      },
      {
        "id": "8f79b1bc-4c9b-47dd-9361-e1d88d433c1f",
        "name": "6c958397294c279dcbe806c1403c229fdb5ca3ffe030d4d8ce1533e9e7810af4"
      },
      {
        "id": "36164c44-853c-405b-ac28-eaf169a11469",
        "name": "7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91"
      },
      {
        "id": "5412c433-3406-4eb0-a131-5a99e71932d1",
        "name": "eth.merkle.io"
      },
      {
        "id": "b5dc4957-bae0-4e3e-9918-ed8ca55d04b8",
        "name": "mainnet.gateway.tenderly.co"
      },
      {
        "id": "49cc7d72-de23-4b05-b1e6-fbfa7232512c",
        "name": "http://mainnet.helius-rpc.com/"
      },
      {
        "id": "4a267f9c-a094-4e86-a5cc-000ca20d1528",
        "name": "8kwfaa30jtlnwi.com"
      },
      {
        "id": "dee12bdb-f67c-4648-ada4-0e977198b9ee",
        "name": "http://scanclaw.live/KjYQnKB-.php"
      },
      {
        "id": "b49cae65-7f62-4bb4-aec4-9ec8af3a3857",
        "name": "moonscan.live"
      },
      {
        "id": "ddacd737-389e-4968-80a6-030ecda512de",
        "name": "wpuadmin.shop"
      },
      {
        "id": "281bce0d-f64a-4427-a1de-ca8150e0228f",
        "name": "rpc.mevblocker.io"
      },
      {
        "id": "2477eae7-cdc6-49f6-8b73-bb2f68211627",
        "name": "ba3512ed46270b9cb037bdc3d0b398fad2d3017d1b866645afb7445b089211fa"
      },
      {
        "id": "42975e03-0f7a-4f45-9b12-6a8eddb61086",
        "name": "53d232e7a2670a6f010c23ebd60ca8f881d0433eaf28883a79b41ddd09e47d88"
      },
      {
        "id": "442cb03e-070b-4d5c-a666-57b8225429e1",
        "name": "solana.publicnode.com"
      },
      {
        "id": "b0eb940f-40d4-4563-b0fe-e85406955006",
        "name": "http://corsproxy.io/?hXXps://api.mainnet-beta.solana.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "5882a135-5b7e-4caf-93e8-80f7df41cef2",
        "name": "T1564.001"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "840f859f-575f-487e-8083-6ffd01a13a84",
        "name": "T1218.007"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "38496923-cc42-4ae3-b9e8-2ba9499d1fcb",
        "name": "SUPERNOVA - S0578",
        "slug": "supernova-s0578"
      },
      {
        "id": "4c5f5285-091d-4bf7-8c48-f6b5e6e38fee",
        "name": "EtherRAT",
        "slug": "etherrat"
      },
      {
        "id": "338bce02-6d29-4f31-94ba-ad23268d53f9",
        "name": "MioLab",
        "slug": "miolab"
      },
      {
        "id": "059bc5c3-3e4f-4f7d-a039-b1e0dc85e09b",
        "name": "StepDrainer",
        "slug": "stepdrainer"
      }
    ],
    "observables": [
      {
        "id": "afea422b-9c7b-49e0-90ac-788db968a58a",
        "name": "wpuadmin.shop"
      },
      {
        "id": "e76d7059-3554-4a64-83c1-54724584e86f",
        "name": "scanclaw.live"
      },
      {
        "id": "efde536f-28da-43a1-ab8d-8cb54c8bb126",
        "name": "8kwfaa30jtlnwi.com"
      },
      {
        "id": "099c05f2-d1f9-4667-a430-e5f786278b06",
        "name": "aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com"
      },
      {
        "id": "9769952b-7d3d-4d10-ac67-39ec771203eb",
        "name": "aahdjjsivunugynqjvyfbhqnjekniyfboma.com"
      },
      {
        "id": "281dcc57-ec7f-4f72-9769-5a514074a370",
        "name": "moonscan.live"
      },
      {
        "id": "eb46d6a8-245f-4e78-8ce2-8f71d912260d",
        "name": "eth-mainnet.public.blastapi.io"
      },
      {
        "id": "b78aa32b-5201-4adf-bb84-1f7973995dad",
        "name": "mainnet.gateway.tenderly.co"
      },
      {
        "id": "3bf80b77-8bc6-49ed-85a3-72267f896b5c",
        "name": "rpc.flashbots.net"
      },
      {
        "id": "c9423320-08dc-49d0-a41a-0920894e7c21",
        "name": "rpc.mevblocker.io"
      },
      {
        "id": "124ea071-2f86-461c-a605-0c2d8b997df3",
        "name": "solana.publicnode.com"
      },
      {
        "id": "13225e4e-5c26-4c9b-8718-9551effef550",
        "name": "solana-mainnet.rpc.extrnode.com"
      },
      {
        "id": "b2efa966-3818-4221-b6e9-b25f5f59e0cb",
        "name": "ethereum-rpc.publicnode.com"
      },
      {
        "id": "a4087286-b52f-45be-88e9-6c30b572cc6d",
        "name": "rpc.payload.de"
      },
      {
        "id": "2302c69a-be3c-48d2-bc15-97d2521d085c",
        "name": "mainnet.helius-rpc.com"
      },
      {
        "id": "32d3fd3d-6625-4bea-a069-aba54df67daa",
        "name": "eth.merkle.io"
      },
      {
        "id": "9d4a2d1a-27f3-459f-823e-6733bf1bfdaa",
        "name": "eth.drpc.org"
      },
      {
        "id": "18ba5dd5-5191-478e-bd66-cf128fc741c6",
        "name": "http://corsproxy.io/?hXXps://api.mainnet-beta.solana.com"
      },
      {
        "id": "6c42a48d-f92f-43d9-b79d-d74328305bd9",
        "name": "http://mainnet.helius-rpc.com/"
      },
      {
        "id": "d38c3645-5f8f-46be-a68b-4255e563de7a",
        "name": "http://scanclaw.live/KjYQnKB-.php"
      },
      {
        "id": "c7f954c9-c044-4ae3-9af8-ac009f6f23ed",
        "name": "http://rpc.flashbots.net/fast"
      },
      {
        "id": "2e72ac1a-54bd-466c-a36d-649b984c78bd",
        "name": "http://moonscan.live/7w2NU3Z-.php"
      },
      {
        "id": "",
        "name": "35e01440b9c63f17eb9e70096d2ec01d18309106a0d644db1110950d2d438e59"
      },
      {
        "id": "",
        "name": "c44d5c888647e78947fc93006d92e5521795ef31f7b0cae1ec829fec60d4bd7a"
      },
      {
        "id": "",
        "name": "b3e28c6a4fec257f4cdc63d93c84596c4c0ee67b839c0711e06d771dd5410b96"
      },
      {
        "id": "",
        "name": "73b1d65c05da79b43f5dbddf4736d37b722a8fa6ea649d0ed5089b2bdb2c9e67"
      },
      {
        "id": "",
        "name": "3188313f38e2114f5a9524bf812efaa7f70a89cd8ef2907b962cb1466251df70"
      },
      {
        "id": "",
        "name": "6c958397294c279dcbe806c1403c229fdb5ca3ffe030d4d8ce1533e9e7810af4"
      },
      {
        "id": "",
        "name": "7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91"
      },
      {
        "id": "",
        "name": "ba3512ed46270b9cb037bdc3d0b398fad2d3017d1b866645afb7445b089211fa"
      },
      {
        "id": "",
        "name": "53d232e7a2670a6f010c23ebd60ca8f881d0433eaf28883a79b41ddd09e47d88"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "eth-mainnet.public.blastapi.io"
      },
      {
        "id": "",
        "name": "mainnet.helius-rpc.com"
      },
      {
        "id": "",
        "name": "rpc.flashbots.net"
      },
      {
        "id": "",
        "name": "rpc.payload.de"
      },
      {
        "id": "",
        "name": "ethereum-rpc.publicnode.com"
      },
      {
        "id": "",
        "name": "eth.drpc.org"
      },
      {
        "id": "",
        "name": "aahdjjsivunugynqjvyfbhqnjekniyfboma.com"
      },
      {
        "id": "",
        "name": "solana-mainnet.rpc.extrnode.com"
      },
      {
        "id": "",
        "name": "scanclaw.live"
      },
      {
        "id": "",
        "name": "aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com"
      },
      {
        "id": "",
        "name": "eth.merkle.io"
      },
      {
        "id": "",
        "name": "mainnet.gateway.tenderly.co"
      },
      {
        "id": "",
        "name": "8kwfaa30jtlnwi.com"
      },
      {
        "id": "",
        "name": "moonscan.live"
      },
      {
        "id": "",
        "name": "wpuadmin.shop"
      },
      {
        "id": "",
        "name": "rpc.mevblocker.io"
      },
      {
        "id": "",
        "name": "solana.publicnode.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "4f2ae0d8-7b95-4d57-b71f-38758523e7d1",
      "standard_id": "external-reference--1b7e9da6-cd1c-5316-bc9e-c89fab202d0f",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69ea724596582ed94bc23acf",
      "hash": null,
      "external_id": "69ea724596582ed94bc23acf",
      "created": "2026-04-27T14:41:19.638Z",
      "modified": "2026-04-27T14:41:19.638Z",
      "createdById": null
    },
    {
      "id": "8add179d-cf18-4110-a353-a9f17489224b",
      "standard_id": "external-reference--8bab9970-2df0-55bc-9314-1e0a1813ee19",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.levelblue.com/blogs/spiderlabs-blog/crypto-drainers-as-a-converging-threat-insights-into-emerging-hybrid-attack-ecosystems",
      "hash": null,
      "external_id": null,
      "created": "2026-04-27T14:41:19.752Z",
      "modified": "2026-04-27T14:41:19.752Z",
      "createdById": null
    }
  ]
}