{
  "name": "The Wagmi Manual: Copy, Paste, and Profit",
  "slug": "the-wagmi-manual-copy-paste-and-profit",
  "description": "The Wagmi traffer group, operating since early 2023, specializes in NFT scams and cryptocurrency theft. They utilize sophisticated social engineering tactics, fake web3-themed games, and impersonation of legitimate projects to lure victims. Their operations have allegedly earned over $2.4 million between June 2023 and March 2025. The group employs various techniques, including seed phrase phishing and automated wallet address scraping from social media. They target users of NFT marketplaces and the Web3 community, using fake job offers and enticing game promotions. The group also engages in code signing certificate abuse to bypass security measures and increase infection rates. Their malware payloads include HijackLoader, Lumma C2 infostealer, Rhadamanthys stealer, and AMOS stealer for MacOS.",
  "published": "2025-04-08T08:29:52+00:00",
  "created_at": "2025-04-08T08:29:52+00:00",
  "modified_at": "2025-04-08T09:50:23+00:00",
  "created_at_opencti": "2025-04-08T08:29:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-08",
    "cryptocurrency theft",
    "hijackloader",
    "lummac2",
    "nft scams",
    "rhadamanthys",
    "social engineering"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "85.209.128.59"
      },
      {
        "id": "",
        "name": "186.2.175.33"
      },
      {
        "id": "",
        "name": "185.149.120.235"
      },
      {
        "id": "",
        "name": "http://kosmosgrid.com/macshare.php"
      },
      {
        "id": "",
        "name": "http://asoonworld.com/macshare.php"
      },
      {
        "id": "",
        "name": "http://gamehosting.shop/api"
      },
      {
        "id": "",
        "name": "zoom.us50web.xyz"
      },
      {
        "id": "",
        "name": "us05webs-zoom.pw"
      },
      {
        "id": "",
        "name": "swdgame.xyz"
      },
      {
        "id": "",
        "name": "strikeleaguenft.xyz"
      },
      {
        "id": "",
        "name": "strikeleague.xyz"
      },
      {
        "id": "",
        "name": "strikeforcegame.xyz"
      },
      {
        "id": "",
        "name": "splarecall.xyz"
      },
      {
        "id": "",
        "name": "splarecall.com"
      },
      {
        "id": "",
        "name": "splarecall.cc"
      },
      {
        "id": "",
        "name": "splare.xyz"
      },
      {
        "id": "",
        "name": "splare.cc"
      },
      {
        "id": "",
        "name": "splare.io"
      },
      {
        "id": "",
        "name": "showdowngame.io"
      },
      {
        "id": "",
        "name": "rocketrumblesol.xyz"
      },
      {
        "id": "",
        "name": "rocketrumble.xyz"
      },
      {
        "id": "",
        "name": "rocketlegacygame.com"
      },
      {
        "id": "",
        "name": "rocketlegacy.xyz"
      },
      {
        "id": "",
        "name": "rocketlegacy.net"
      },
      {
        "id": "",
        "name": "rocketlegacy.io"
      },
      {
        "id": "",
        "name": "roboversegame.xyz"
      },
      {
        "id": "",
        "name": "roarlandplay.xyz"
      },
      {
        "id": "",
        "name": "roarland.xyz"
      },
      {
        "id": "",
        "name": "roarland.org"
      },
      {
        "id": "",
        "name": "roarland.io"
      },
      {
        "id": "",
        "name": "playswdbtc.xyz"
      },
      {
        "id": "",
        "name": "playswd.xyz"
      },
      {
        "id": "",
        "name": "playstrikeforcenow.com"
      },
      {
        "id": "",
        "name": "playrocketrumble.xyz"
      },
      {
        "id": "",
        "name": "playshowdown.xyz"
      },
      {
        "id": "",
        "name": "playrobovrs.xyz"
      },
      {
        "id": "",
        "name": "playrocketlegacy.xyz"
      },
      {
        "id": "",
        "name": "playroboverse.xyz"
      },
      {
        "id": "",
        "name": "playroarland.xyz"
      },
      {
        "id": "",
        "name": "playgunrushnow.xyz"
      },
      {
        "id": "",
        "name": "playgunrush.xyz"
      },
      {
        "id": "",
        "name": "playapestars.com"
      },
      {
        "id": "",
        "name": "playanimalia.xyz"
      },
      {
        "id": "",
        "name": "kosmosgrid.com"
      },
      {
        "id": "",
        "name": "junglelegends.xyz"
      },
      {
        "id": "",
        "name": "junglelegends.io"
      },
      {
        "id": "",
        "name": "jungle-legends.io"
      },
      {
        "id": "",
        "name": "jungle-legends.com"
      },
      {
        "id": "",
        "name": "gunrushgame.xyz"
      },
      {
        "id": "",
        "name": "gunrush.xyz"
      },
      {
        "id": "",
        "name": "gamehosting.shop"
      },
      {
        "id": "",
        "name": "asoonworld.com"
      },
      {
        "id": "",
        "name": "astriia.com"
      },
      {
        "id": "",
        "name": "apestarshq.xyz"
      },
      {
        "id": "",
        "name": "apestarshq.org"
      },
      {
        "id": "",
        "name": "apestarshq.net"
      },
      {
        "id": "",
        "name": "apestarshq.io"
      },
      {
        "id": "",
        "name": "apestarshq.com"
      },
      {
        "id": "",
        "name": "apestars.io"
      },
      {
        "id": "",
        "name": "aperoyaleplay.io"
      },
      {
        "id": "",
        "name": "aperoyaleplay.com"
      },
      {
        "id": "",
        "name": "aperoyale.net"
      },
      {
        "id": "",
        "name": "animaliagame.net"
      },
      {
        "id": "",
        "name": "animalia-game.xyz"
      },
      {
        "id": "",
        "name": "animaliagame.xyz"
      },
      {
        "id": "",
        "name": "us09web-zoom.us"
      },
      {
        "id": "",
        "name": "us08web-zoom.us"
      },
      {
        "id": "",
        "name": "us050web-zoom.us"
      },
      {
        "id": "",
        "name": "us01web-zoom.us"
      },
      {
        "id": "",
        "name": "us008web-zoom.us"
      },
      {
        "id": "",
        "name": "us007web-zoom.us"
      },
      {
        "id": "",
        "name": "us006web-zoom.us"
      },
      {
        "id": "",
        "name": "us005web-zoom.us"
      },
      {
        "id": "",
        "name": "us004web-zoom.us"
      },
      {
        "id": "",
        "name": "us003webzoom.us"
      },
      {
        "id": "",
        "name": "us002webzoom.us"
      },
      {
        "id": "",
        "name": "ultimateplay.xyz"
      },
      {
        "id": "",
        "name": "ultimategame.xyz"
      },
      {
        "id": "",
        "name": "playultimate.xyz"
      },
      {
        "id": "",
        "name": "playbattleforge.xyz"
      },
      {
        "id": "",
        "name": "playbattleforge.org"
      },
      {
        "id": "",
        "name": "myultimate.xyz"
      },
      {
        "id": "",
        "name": "mybattleforge.xyz"
      },
      {
        "id": "",
        "name": "battleultimate.xyz"
      },
      {
        "id": "",
        "name": "battleforge.cc"
      },
      {
        "id": "",
        "name": "ecdd79c3228b8f354e6c0148c00038790bd8a874428dc9b3f57111e753d3565f"
      },
      {
        "id": "",
        "name": "e0e0b3d2890053cbdf84d6c3177e267d8f767f4b2b6d6e5fb2de5860b0a09ee2"
      },
      {
        "id": "",
        "name": "d516515e923875ae22b6325bba9e53f5fa531aa7c6c7a386fb380f3ae92b5009"
      },
      {
        "id": "",
        "name": "9f4e52d4dfb7ebf09e0371a92280ad21519030f7032077cba125903454dd211d"
      },
      {
        "id": "",
        "name": "75ba94534ea1433f70c57de43b27b9dc1c9f310e004fa5c70ad3e6b79650328a"
      },
      {
        "id": "",
        "name": "38eff554ddee7664cd8b1c003ddf96f7ebe608acbe236b74e9045fd831a0c100"
      },
      {
        "id": "",
        "name": "42735792cc7e76b7439751d4aa673d5bd61d100f8d4de42c9084db46e2a1dbf1"
      },
      {
        "id": "",
        "name": "2005bd6b7613d7c6bc8ea6e179f498b05feb185237511eebce44a5d3d87662ec"
      },
      {
        "id": "",
        "name": "1d879fb13ed76a9892d8e9ea99aa6817cd1248d409956c1ab1b47c2f79c103bd"
      },
      {
        "id": "",
        "name": "1ae7cdd81585233bfb3871385c67dd7fb43bfb2231ab2af5aded08d49c490f16"
      },
      {
        "id": "",
        "name": "154af50ab1f4b14e10b2532574c3856bbdadaabb042ade5bf39a7153cb9e89f8"
      }
    ],
    "malware": [
      {
        "id": "ed4cbf67-af05-4eb5-9a37-b51f6496b183",
        "name": "AMOS",
        "slug": "amos"
      },
      {
        "id": "5a707c14-0cb1-4113-a7f6-02c0c32699e3",
        "name": "HijackLoader",
        "slug": "hijackloader"
      },
      {
        "id": "legacy:malware:37dce7f2f14d48d9",
        "name": "LummaC2",
        "slug": "lummac2"
      },
      {
        "id": "legacy:malware:96d5163803bd1444",
        "name": "Rhadamanthys",
        "slug": "rhadamanthys"
      }
    ],
    "intrusion_sets": [
      {
        "id": "c3958b04-a0b0-445a-b9ef-527a0b89e7c0",
        "name": "Wagmi",
        "slug": "wagmi"
      }
    ],
    "attack_patterns": [
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "2c3d4267-2bae-41ae-8486-5876953a1748",
        "name": "T1129"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ]
  },
  "external_refs": [
    "https://trac-labs.com/the-wagmi-manual-copy-paste-and-profit-2803a15bf540",
    "https://otx.alienvault.com/pulse/67f4faa0ced84c07a0fad6d8"
  ]
}