Kaspersky Reports 135% Increase in Discussions About Crypto-Drainers on Dark Web, Indicating Growing Risk

Conversations regarding crypto-drainers, malicious software intended to deplete cryptocurrency wallets, have increased by 135% on dark web forums.

According to a report from global cybersecurity firm Kaspersky, discussions about crypto-drainers on the dark web grew from 55 threads in 2022 to 129 threads in 2024.

These forums have turned into a central location for cybercriminals to buy, sell, and distribute malware, as well as to recruit accomplices for wider distribution initiatives.

Rising Interest in Illegal Trade

The notable rise in discussions concerning crypto-drainers indicates an escalating interest in the illegal trade and creation of these tools among cybercriminals, as stated in the report.

Crypto-drainers, which have been operational for approximately three years, function by tricking users into approving fraudulent transactions.

Cybercriminals employ strategies such as phishing websites, counterfeit airdrops, harmful browser extensions, deceptive smart contracts, and imitation NFT marketplaces to accomplish their objectives.

Alexander Zabrovsky, a cybersecurity specialist at Kaspersky, cautioned that this increasing trend in crypto-drainer activity is likely to persist into 2025.

He advises businesses and organizations to enhance their vigilance, oversee their digital footprint, and respond promptly to counter fraudulent actions.

Drainers frequently take advantage of the brand recognition of prominent wallets and exchanges to ensnare unsuspecting victims.

Kaspersky’s report also notes a 40% rise in the number of posts promoting corporate databases on one of the most active dark web forums.

Between August and November 2024, the quantity of such posts expanded significantly.

While some of these database listings feature old leaks presented as new, they reflect a continuous demand for corporate data.

Dark web and dark market in 2025: What’s next?
Our latest predictions reveal:
– Rise in trusted relationship attacks and real/fake data leaks
– Cybercriminals shifting back to #darkweb forums as #Telegram bans increase
– META region poised for a surge in hacktivism and… pic.twitter.com/0iEePvZmYR

— Kaspersky (@kaspersky) December 19, 2024

Zabrovsky indicated that certain breach advertisements are entirely fabricated, often merging publicly accessible information with older leaked data.

These methods are employed to harm corporate reputations or attract attention in underground markets.

He recommended that companies monitor mentions of their brands and data on dark web platforms to facilitate a rapid response to potential breaches.

Cybersecurity Outlook for 2025

Kaspersky’s outlook for 2025 anticipates a change in cybercriminal behavior.

Criminals are predicted to move away from Telegram channels back to dark web forums following a series of bans targeting Telegram-based activities.

Moreover, heightened law enforcement actions against significant cybercrime groups in 2024 may drive malicious actors toward invite-only forums to avoid detection.

The threat of ransomware is also evolving. Kaspersky expects ransomware groups to fragment into smaller, more agile units, complicating efforts for authorities to track and dismantle them.

Malware-as-a-Service (MaaS) operations, which allow criminals to rent drainers and stealers, are also anticipated to expand.

This is likely to lead to an increased volume of stolen data being sold on underground platforms.

The Middle East is especially susceptible to this changing threat landscape.

Geopolitical tensions in the region are expected to contribute to a rise in hacktivism and ransomware attacks.

Data indicates that ransomware victims in the region rose from an average of 28 per half-year in 2022-2023 to 45 in the first half of 2024.

Recently, it was disclosed that cybersecurity scammers are utilizing automated email replies to compromise systems and deploy stealthy crypto mining malware.

This development followed another malware threat identified in August.

The “Cthulhu Stealer,” which impacts MacOS systems, similarly masquerades as legitimate software and targets personal information, including MetaMask passwords, IP addresses, and cold wallet private keys.

The post Dark Web Sees 135% Spike in Crypto-Drainer Discussions, Signaling Rising Threat: Kaspersky appeared first on Cryptonews.