Operation ASTERIX: Detecting the AI-Built Crypto Fraud Pipeline — Fake Wallets, Vishing Panels, and Telegram Exfiltration

---
title: Unsigned Electron Application Executing from User-Writable Path
id: 3f7c2a91-8b4e-4d5a-9c1f-6e8b2a4d7f01
status: experimental
description: Detects execution of Electron-based applications (large unsigned binaries with Electron characteristics) launched from user-writable directories such as Downloads, AppData\Local\Temp, or user Desktop — consistent with fake cryptocurrency wallet droppers observed in Operation ASTERIX-style fraud pipelines.
references:
  - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Desktop\'
  selection_wallet_lure:
    Image|contains:
      - 'wallet'
      - 'ledger'
      - 'trezor'
      - 'metamask'
      - 'exodus'
      - 'coinbase'
      - 'binance'
      - 'crypto'
  filter_known_good:
    Image|contains:
      - '\AppData\Local\Microsoft\'
      - '\AppData\Local\Programs\Signal\'
      - '\AppData\Local\Programs\Microsoft VS Code\'
      - '\AppData\Roaming\Telegram Desktop\'
  condition: selection_paths and selection_wallet_lure and not filter_known_good
falsepositives:
  - Legitimate community wallet software installed per-user — verify code signing certificate and vendor hash before dismissal
level: high
---
title: Persistence Registration Masquerading as Cryptocurrency Wallet Software
id: 8a1e4b62-3c7d-4f2a-b5e9-1d6c8a3f5b92
status: experimental
description: Detects registry Run key persistence entries whose value names or target paths reference cryptocurrency wallet branding, consistent with fake wallet persistence mechanisms recovered from Operation ASTERIX infrastructure.
references:
  - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
  selection_lure:
    TargetObject|contains:
      - 'wallet'
      - 'ledger'
      - 'trezor'
      - 'metamask'
      - 'exodus'
      - 'coinbase'
      - 'binance'
      - 'blockchain'
      - 'crypto'
  condition: selection_key and selection_lure
falsepositives:
  - Legitimate wallet auto-update entries — validate signer and install source; genuine vendors sign their binaries and document their autostart entries
level: high
---
title: Non-Telegram Process Connecting to Telegram Bot API
id: 5c9d3f47-2a8b-4e6c-91d4-7b2e5f8a1c63
status: experimental
description: Detects outbound HTTPS connections to the Telegram Bot API endpoint (api.telegram.org) initiated by processes other than the legitimate Telegram client — a strong indicator of commodity exfiltration code with hardcoded bot tokens, as recovered from Operation ASTERIX.
references:
  - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname: 'api.telegram.org'
  filter_client:
    Image|contains:
      - '\Telegram Desktop\'
      - '\Telegram.exe'
  condition: selection and not filter_client
falsepositives:
  - Legitimate IT automation or monitoring scripts using Telegram bots for alerting — inventory and allowlist known internal bot integrations by process path
level: high

// Hunt: Operation ASTERIX-style fake wallet + Telegram exfiltration
// Part 1: Processes with crypto-wallet lures launched from user-writable paths,
//         correlated with subsequent Telegram API egress within 30 minutes.
let lureProcs = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("wallet", "ledger", "trezor", "metamask", "exodus", "coinbase", "binance", "crypto")
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\Desktop\\", "\\AppData\\Roaming\\")
| where not(FolderPath has_any ("Telegram Desktop", "Microsoft VS Code", "\\AppData\\Local\\Microsoft\\"))
| project WalletTime=TimeGenerated, DeviceName, DeviceId, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessAccountName;
let tgEgress = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl == "api.telegram.org"
| where not(InitiatingProcessFolderPath has "Telegram Desktop")
| project TgTime=TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
lureProcs
| join kind=inner tgEgress on DeviceId
| where TgTime between (WalletTime .. WalletTime + 30m)
| project WalletTime, TgTime, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessAccountName
| order by WalletTime desc;
// Part 2 (standalone): Sentinel Syslog/CEF view for egress to Telegram Bot API from Linux/macOS hosts
// CommonSecurityLog
// | where TimeGenerated > ago(7d)
// | where DestinationHostName == "api.telegram.org"
// | summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
//     by SourceHostName, SourceProcessName, DestinationIP
// | order by ConnectionCount desc;

-- Operation ASTERIX hunt artifact: fake Electron wallets + Telegram exfil
-- 1) Running processes with wallet-lure names executing from user-writable paths
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)(wallet|ledger|trezor|metamask|exodus|coinbase|binance|crypto)')
  AND (Exe =~ '(?i)(Downloads|AppData\\\\Local\\\\Temp|Desktop|AppData\\\\Roaming)')
  AND NOT (Exe =~ '(?i)(Telegram Desktop|VS Code|AppData\\\\Local\\\\Microsoft)')

-- 2) Unsigned executables dropped in per-user locations (Electron payloads are
--    frequently unsigned or self-signed); enrich with Authenticode outside VQL
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/Downloads/*.exe',
                 'C:/Users/*/AppData/Local/Temp/*.exe',
                 'C:/Users/*/Desktop/*.exe'])
WHERE FullPath =~ '(?i)(wallet|ledger|trezor|metamask|exodus|coinbase|binance|crypto|setup|update)'
  AND Mtime > now() - 604800

-- 3) Established outbound connections to Telegram API infrastructure (149.154.160.0/20, 91.108.4.0/22)
SELECT Pid, Name, Status, Family, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND (Raddr =~ '^(149\\.154\\.|91\\.108\\.)')
  AND NOT (Name =~ '(?i)telegram')

-- 4) Run-key persistence entries referencing wallet branding
SELECT Name, FullPath AS KeyPath, { SELECT StringValue FROM stat(filename=FullPath) } AS Value
FROM glob(globs=['HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*',
                 'HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*'],
          accessor='registry')
WHERE Name =~ '(?i)(wallet|ledger|trezor|metamask|exodus|coinbase|binance|blockchain|crypto)'

# Operation ASTERIX endpoint audit — run elevated on suspected Windows endpoints
# 1) Enumerate wallet-branded persistence in Run/RunOnce keys (HKLM + HKCU + all user hives)
$lure = '(?i)(wallet|ledger|trezor|metamask|exodus|coinbase|binance|blockchain|crypto)'
$runPaths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
              'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
              'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
              'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($p in $runPaths) {
  if (Test-Path $p) {
    Get-ItemProperty $p | ForEach-Object {
      $_.PSObject.Properties | Where-Object { $_.Name -match $lure -or $_.Value -match $lure } |
        ForEach-Object { [PSCustomObject]@{Key=$p; Name=$_.Name; Value=$_.Value} }
    }
  }
}

# 2) Find unsigned wallet-lure executables in user-writable paths (last 30 days)
$paths = @("$env:SystemDrive\Users\*\Downloads", "$env:SystemDrive\Users\*\Desktop",
           "$env:SystemDrive\Users\*\AppData\Local\Temp", "$env:SystemDrive\Users\*\AppData\Roaming")
Get-ChildItem -Path $paths -Recurse -Include *.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match $lure -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') {
      [PSCustomObject]@{Path=$_.FullName; SizeKB=[math]::Round($_.Length/1KB);
                        LastWrite=$_.LastWriteTime; SigStatus=$sig.Status;
                        SHA256=(Get-FileHash $_.FullName -Algorithm SHA256).Hash}
    }
  }

# 3) Audit scheduled tasks for wallet-lure names or user-path actions
Get-ScheduledTask | ForEach-Object {
  $t = $_
  $t.Actions | Where-Object { $_.Execute -match $lure -or $_.Execute -match '(?i)AppData|Downloads|Temp' } |
    ForEach-Object { [PSCustomObject]@{Task=$t.TaskName; State=$t.State; Action=$_.Execute; Args=$_.Arguments} }
}

# 4) Flag recent DNS cache hits for api.telegram.org on hosts that should not run Telegram
Get-DnsClientCache | Where-Object { $_.Entry -match 'api\.telegram\.org' } |
  Select-Object Entry, Data, TimeToLive

# 5) HARDENING: block Telegram Bot API egress via Windows Firewall (only on endpoints
#    where Telegram is not an approved business tool — validate against policy first)
# New-NetFirewallRule -DisplayName "Block Telegram Bot API Egress" -Direction Outbound `
#   -RemoteAddress @("149.154.160.0/20","91.108.4.0/22","91.108.56.0/22","95.161.64.0/20") `
#   -Protocol TCP -RemotePort 443 -Action Block -Profile Any