A Deep Dive into the GreedyBear Attack

The GreedyBear crypto theft campaign actors have already reportedly amassed more than US$1 million. According to Koi Security, the attackers used 150 weaponized Firefox extensions, close to 500 malicious executables, and dozens of phishing sites.

The company identified 18 domains as indicators of compromise (IoCs).¹ WhoisXML API dove deeper into the attack in a bid to uncover more information and new artifacts. Our in-depth analysis of the IoCs led to these discoveries:

• One unique client IP communicated with one unique domain IoC
• Five domain IoCs deemed likely to turn malicious 33–82 days before they were dubbed as such on 8 August 2025
• One email-connected domain
• Four IP addresses, three were malicious
• 11 IP-connected domains
• 607 string-connected domains, five were malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.koi.security/blog/greedybear-650-attack-tools-one-coordinated-campaign