The campaign, called Operation ASTERIX, combined account checks, phishing emails, voice calls, fake wallet apps, and Telegram-based data theft.
The name comes from Asterisk, the open-source phone system found on the exposed server. Attackers used it to support vishing, or voice phishing, by linking automated calls with fake support emails and malicious wallet software.
The exposed directory gave researchers an unusually detailed look at the operation. It contained raw phone-number lists, account-checking tools, phishing panels, lead databases, dialer scripts, fake Ledger, Trezor, and Exodus apps, plus code used to send stolen wallet recovery phrases to Telegram bots.
Rapid7 said it notified relevant providers and authorities while much of the infrastructure was still active. Apple’s security team was also notified about the activity.
ASTERIX Crypto User Targeting
The attackers did not simply call random numbers. They first used bulk validation tools to determine whether a phone number was connected to a cryptocurrency account. This let them focus their fraud effort on people more likely to own digital assets.
One recovered tool targeted a Crypto.com account-verification endpoint. It submitted phone numbers using 300 concurrent threads, retry logic, and rotating residential proxies.
From a German dataset containing 316,002 mobile numbers, the tool reportedly confirmed 43,066 crypto-linked accounts a hit rate of around 13.6%.
Other files indicated that the operators also maintained a Kraken account checker and separate datasets for Ledger users, UK targets, Canadian fintech users, Hong Kong residents, and other regions. Ledger-related records were split across 54 country files.
After validation, the group enriched the most valuable records. Files such as valids.txt and valid_leads.db reportedly included names, email addresses, phone numbers, location details, account context, and sometimes payment-card information. This data helped scammers make calls sound credible.
For example, an attacker could email a target about a fake security case, then call and quote the same case number and verification code.
Because the caller already knew the victim’s name and possible exchange connection, the interaction could look like legitimate customer support.
The phishing panels impersonated brands including Crypto.com and Binance. Meanwhile, Asterisk and 3CX phone-system software supported outbound calling.
Scripts such as autodialer.sh and power_dialer.sh suggest the operators could automate parts of the calling process.
However, recovered logs showed only a limited number of emails and lead lookups over two weeks. This suggests a targeted, hands-on campaign rather than a broad automated phishing operation, Rapid7 said.
Indicators of Compromise
| Type | Indicator | Details |
|---|---|---|
Shared app.asar SHA-256 | ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19 | Shared payload across the fake Trezor builds |
| Declared integrity hash | 918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2 | macOS integrity value; reportedly mis |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
