Analysis: Crypto Wall 3.0, Dyre and I2P
Summary: Unit 42 reports that CryptoWall 3.0 and the Dyre banking Trojan have both begun abusing the I2P anonymity network in recent weeks, with CryptoWall 3.0 reaching .i2p "eepSites" to serve a decrypting service to victims, the same role Tor played for CryptoWall 2.0 in October. Dyre maintains multiple C2 mechanisms - encrypted HTTPS requests to hard-coded IP addresses, a DGA generating 1,000 new domains each day, and an I2P-based plugin - which the researchers say makes it far harder to fully take down than a single C2.
Key Takeaway: Dyre's DGA alone produces 1,000 new domains every day, so domain denylists and takedowns cannot keep pace, and the I2P plugin adds a channel that never touches those domains at all.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026