Threat Actors Rapidly Adopt Web3 IPFS Technology
Summary: Unit 42 observed an 893% increase in IPFS-related traffic across Palo Alto Networks from the last quarter of 2021 through the end of 2022, while VirusTotal reported over a 27,000% increase over the same period. Analysts attributed the rise to threat actors using the decentralized Web3 file system for phishing, credential theft, and malicious payload distribution, with RansomEXX releasing stolen victim data via IPFS and malware families including Smoke Loader, XLoader, XMRig, and OriginLogger using IPFS links for delivery.
What you should know: Because content published to IPFS can be republished across multiple nodes, takedown requires requests to every host, and if any one refuses, the content is virtually impossible to remove - extending phishing campaign lifetimes beyond the short TTLs defenders rely on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026