Full Report
A global cryptocurrency phishing operation likely based in India or Sri Lanka has been stealing digital assets since at least 2022
Analysis Summary
# Threat Actor: FreeDrain
## Attribution & Identity
The operation is dubbed **FreeDrain** by investigators (Validin and SentinelLabs). Attribution strongly suggests the actors are based in **India** (or possibly Sri Lanka), based on analysis of commit timestamps correlating to the UTC+05:30 (IST) timezone and 9-to-5 weekday work patterns observed in metadata from services like GitHub and Webflow. The operation has been active since at least **2022**.
## Activity Summary
FreeDrain operates a large-scale, sophisticated, and long-running cryptocurrency phishing network primarily targeting web3 projects to steal cryptocurrency wallet seed phrases and drain associated funds. Unlike traditional phishing, FreeDrain leverages **SEO manipulation** and **layered redirection techniques** to meet victims actively searching for wallet support or balance checks on major search engines. The operation saw a significant increase in activity around mid-2024. Reports indicate victims have lost substantial amounts, such as 8 Bitcoins (valued around $500,000 at the time of reporting). Stolen assets are quickly laundered using one-time-use addresses and cryptocurrency mixers.
## Tactics, Techniques & Procedures
- **SEO Manipulation/Spamdexing:** Using techniques designed to achieve high ranking for wallet-related search queries.
- **Free-Tier Web Hosting Abuse:** Utilizing services like Amazon S3, Microsoft Azure Web Apps, GitHub.io, WordPress.com, Gitbook, and GoDaddySites to host lure pages, exploiting the high reputation of these domains.
- **Typosquatting:** Employed to create deceptive domains or subdomains.
- **Layered Redirection:** Used to guide victims to the final malicious payload.
- **Content Generation via AI:** Evidence suggests the operators used Large Language Models (LLMs), potentially noting strings associated with **GPT-4o mini** ('4o mini'), for scalable content generation on lure pages.
- **Social Engineering in Lure Pages:** Lure pages often presented as straightforward wallet balance checkers, sometimes ironically including text advising users on how to avoid phishing.
- **Spam Commenting:** Large-scale spamming on poorly maintained websites was used to increase the visibility and indexing of lure pages.
- **Credential Harvesting:** Targets are tricked into submitting their wallet seed phrases/recovery phrases.
## Targeting
- **Sectors:** Web3 projects, Cryptocurrency holders.
- **Geography:** Global, though operations are managed from the Indian subcontinent.
- **Victims:** Cryptocurrency users attempting to check wallet balances or seek support, who are subsequently tricked into entering seed phrases.
## Tools & Infrastructure
- **Malware Families used:** N/A (This is a credential harvesting/phishing operation, not malware delivery, though the result is theft).
- **Infrastructure (C2, domains, IPs):**
- Hosted lure pages across **38,048 distinct subdomains**.
- Utilized free-tier and cloud infrastructure, including **Amazon S3**, **Microsoft Azure Web Apps**, **GitHub.io**, **WordPress.com**, **Gitbook**, and **Webflow.io**.
- Stolen funds channeled through **cryptocurrency mixers**.
## Implications
FreeDrain represents an industrial-scale, evolving threat in the crypto ecosystem. By weaponizing legitimate, high-reputation cloud services and search engine optimization, the actors bypass traditional security measures focused on email or known malicious domains. The reliance on generative AI suggests a capability for rapid scaling and adaptation of phishing content, making detection challenging. The use of mixers ensures swift and effective monetization of illicit gains.
## Mitigations
- **For Content Platforms (e.g., GitHub/Gitbook):**
- Improve abuse reporting mechanisms directly from published content pages.
- Establish direct communication channels with recognized threat intelligence analysts.
- Implement basic abuse prevention tooling to monitor for bulk account creation and similar domain structures.
- Enhance detection capabilities for coordinated abuse patterns (e.g., repetitive naming, identical templates across subdomains).
- **For Users/Organizations:**
- Exercise extreme caution when searching for wallet support or balance interfaces; verify URLs carefully, especially those linking from search results.
- Never input seed phrases into a web interface where the address is not confirmed to be the official, native wallet application or a rigorously validated service.