ASEC Finds Korean Company-Impersonation Sites Requesting Cryptocurrency Payments
Summary
ASEC identified Korean company-impersonation sites offering cryptocurrency deposits and withdrawals, including a wallet that received about 13 million USDT. No link to ValleyRAT or proof of financial fraud has been confirmed.
Key points
- The sites impersonated Korean companies including Doosan Robotics and Cheonjeong, using their logos, promotional videos, and descriptions.
- The sites offered registration, VIP memberships, and cryptocurrency deposits and withdrawals; chat support instructed users to pay in USDT via TRON and submit transaction screenshots.
- Analysis of a wallet associated with chumchuru[.]com found five deposits and three withdrawals; the wallet received approximately 13 million USDT.
- ASEC identified 12 potentially associated domains using prior web observations, HTML titles, and a search related to ColorUI for UniApp.
- The infrastructure investigation began with 14.128.53[.]155, an IP address described as related to ValleyRAT command-and-control infrastructure.
- ASEC said no direct operational link between ValleyRAT and the websites or wallets has been confirmed, and the funds have not been proven to come from financial fraud.
Article Details
- Event Type
- Discovery of suspicious websites impersonating Korean companies and requesting cryptocurrency payments.
- Impact
- The websites used company branding and offered cryptocurrency deposit and withdrawal functions. Analysis of one wallet found five USDT deposits and three withdrawals; approximately 13 million USDT was reported as received by that wallet. The source says it has not been proven that the funds came from financial fraud, and no direct operational link between these websites or wallets and the ValleyRAT operation has been confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chumchuru[.]com | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurum[.]org | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurum[.]xyz | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurumc[.]com | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurumcc[.]com | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurumm[.]xyz | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurumum[.]com | Additional potentially associated domain identified in a search; its relationship to the suspicious websites is not confirmed. |
| DOMAIN | chumchurumun[.]cc | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | chumchurumun[.]com | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | cycl[.]top | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | cyclx[.]top | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| DOMAIN | doosvnrobotics[.]com | Identified among domains associated with suspicious company-impersonation websites; no direct link to the ValleyRAT operation is confirmed. |
| IPV4 | 14[.]128[.]53[.]155 | IP address described as related to ValleyRAT C2 infrastructure; the article does not confirm an operational link between ValleyRAT and the impersonation websites or wallets. |