Angel Drainer is a group that steals digital assets using phishing pages. It became known for its thefts in 2023. It runs a “Drainer as a Service” (DaaS) model, where it rents a panel to other criminals who then create and spread a malicious tool called a drainer. The panel owners take a share of what their partners steal.
What Is Angel Drainer?
In 2023, the Angel Drainer group, which became known for their thefts, is a group that steals digital assets using phishing pages. The Angel Drainer group has a “Drainer as a Service” (DaaS) business model.
How Does the Drainer as a Service Model Work?
DaaS is a business model used by threat actors to steal digital assets. In this model, cybercriminals rent a panel to other cybercriminals who have less technical knowledge or do not want to deal with complex tasks. By using this rented panel, it becomes possible to easily create and distribute malicious software called “drainer.” The owners of the panel also receive a certain share of the thefts carried out by their partners.
What Will You Learn From the Angel Drainer Report?
- Learn Technical Method of operation Details
You will find the technical details of the Angel Drainer Group, its functions, and details about cyber attack tactics. The report will show many points about its technical details, detections, and IoCs. - Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats. - Response&Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. Angel Drainer Group employs sophisticated techniques to avoid analysis by security researchers. You need experts’ perspective.
What Does the Angel Drainer Report Cover?
The report is a technical study of the Angel Drainer wallet drainer group. It looks at how the group tracks stolen funds, how it runs its business, how its drainer works and how its affiliates attack. Its chapters are the introduction, executive summary, the group’s operational model, its phishing sites, its panel, its cryptocurrency wallets, the malicious JavaScript file and a conclusion.
How the Group Runs Its Business
- The malware supports the Ethereum, Tron and Solana networks, according to the report.
- The report says the group talks to its affiliates on Telegram, and that Telegram bots help manage the operation.
- It describes a user guide in Russian and English, and an affiliate level system. All levels except the lowest one get access to private chat rooms.
- Affiliates can use ready-made phishing templates or build their own front end. The report lists the projects those templates imitate and shows some pages hosted on IPFS.
How the Panel Builds a Drainer
The report walks through the five steps of the panel. The first sets up the wallet connection. The second sets the popup for the phishing page. The third sets withdrawal priorities and the “Two Step Draining” option for EVM-based networks. The fourth covers fake Wallet Connect data, logging and buttons. The fifth compiles the malware.
What the Malicious JavaScript Does
- It is added to every phishing site as a file called malware.js.
- Its packed data is unpacked in the browser with a WebAssembly decompressor.
- It contains code to spot high-value NFT collections and to sell stolen assets on decentralized exchanges.
- It checks for wallet-protection simulators to avoid detection, and the report says it can bypass security measures in MetaMask and Coinbase Wallet.
- It uses WalletConnect to link the victim’s wallet, and it logs information such as IP addresses.
- It uses a smart contract to point to a second script, fallback.js. The report notes that such contracts cannot be stopped or blocked.
Following the Money
The report says the group relies on many temporary wallets that stop being used once their assets are withdrawn. It says stolen assets were mostly moved to the KuCoin exchange, and that the group also used eXch. It describes the group’s members as being of Russian origin.
The report includes a table of wallet and smart contract addresses linked to the group, so defenders can check them against their own logs.