Derivative Trading Platform SignalPlus Loses Under $82K from attacks

[fullfitlarry]

Hongkong based derivative trading platform, SignalPlus has confirmed that they have been compromised,



https://x.com/SignalPlus_Web3/status/2118334613374329154

Losses are not that big though, as according to them it's below $82k and funds is SAFU and they have started reimbursing their customers.

Here's their incident report:

Incident Summary
Based on our investigation so far, the incident originated from a compromised Telegram account belonging to a contact at one of our third-party technology vendors. Posing as this contact, the attacker communicated with one of our engineers and sent a fake Microsoft Teams meeting invitation. This social engineering attack compromised the engineer’s computer, where the attacker then remained dormant.
In the early hours of November 4, the attacker began using the engineer’s access privileges to attack our internal network. Upon detecting the activity, we blocked the attack and closed the vulnerabilities identified. We then contacted our exchange partners to proactively disable all SignalPlus-related API keys and safeguard user funds, and promptly placed all SignalPlus services into maintenance mode.

And just like any other attacks that we have seen lately, initial target is 3rd party services->social engineering attack. Lessons here that we might consider best practice is to monitor your service real time, 24x7 and if they suspected of an intrusion, then stop your services immediately and then contact your partners, like here, Binance and Deribit that's why they revoked SignalPlus API right away so that there could no spill over to their partners.

[boyptc]

Another employee's negligence. It's said that it all started with a third party telegram account pretended as their contact.

As per that tweet, the attacker sent a fake microsoft teams invitation and then the employee/engineer clicked on that link that had opened the door for the attack.

It had infected the engineer's computer and the social engineering happened. So with these attacks, they're getting an approval through the malicious way that everyone might be aware of.

But still, this employee fell for it and that's almost the same scenario with binance's hack. Could it be that the same group had made this attack?

[Yamane_Keto]

hacks were discovered after they began withdrawing funds. they remained undetected until then is a catastrophic failure. engineering team being deceived by fake Microsoft Teams is a poor communication among team members and an inability to distinguish between actual colleagues and an AI-generated chat participant.