العدد الورقى

الارشيف

أخر الأخبار

Winnti Group targets video game developers again, ESET researchers uncover

  • Thursday 21 May 2020 14:13 - الخميس ٢٩ رمضان ١٤٤١

    • By : Mohamed Shawky

     

    ESET researchers have discovered a new modular backdoor used by the Winnti Group against several video game companies that develop MMO (massively multiplayer online) games. The malware, named PipeMon by ESET, targeted companies in South Korea and Taiwan.

    The video games developed by these companies are distributed all around the world, are available on popular gaming platforms, and have thousands of simultaneous players.

     

    In at least one case, the attackers compromised the companys build orchestration server, allowing them to take control of the victims automated build systems. This could have allowed the attackers to trojanize video game executables.

    However, we do not have evidence this has occurred, says Mathieu Tartare, Malware researcher at ESET. In another case, the operators compromised the companys game servers.

    With this attack, it would be possible to manipulate in-game currencies for financial gain. ESET contacted the affected companies and provided the necessary information and assistance to remediate the compromise.

     

    Multiple indicators led us to attribute this campaign to the Winnti Group. Some of the command and control domains used by PipeMon were used by Winnti malware in previous campaigns. Furthermore, in 2019 other Winnti malware was found at some of the same companies that were later discovered to be compromised with PipeMon in 2020, says Mathieu Tartare, ESET researcher monitoring the Winnti Group. There are other notable similarities that researchers explore in the blogpost.

     

    The new modular backdoor PipeMon is signed with a code-signing certificate likely stolen during a previous campaign and shares similarities with the PortReuse backdoor.

    This new implant shows that the attackers are actively developing new tools using multiple open source projects and dont rely solely on their flagship backdoors, ShadowPad and the Winnti malware, adds Tartare. ESET was able to trace two different variants of PipeMon.

     

    For more technical details about the latest Winnti backdoor, read the blogpost No Game over for the Winnti Group on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

     

    The Winnti Group, active since at least 2012, is responsible for high-profile supply-chain attacks against the video game and software industries, leading to the distribution of trojanized software (such as CCleaner, ASUS LiveUpdate and multiple video games) that is used to compromise more victims.

    Recently, ESET researchers also discovered a campaign of the Winnti Group targeting several Hong Kong universities with ShadowPad and the Winnti malware. More details about the groups arsenal are explored in a white paper published in October 2019.



    أخبار ذات صلة

    Contact Hosts High-Level Iraqi Financial Delegation to Strengthen Regional Cooperation and Exchange Expertise

    e& Egypt Enhances Business Agility with Cisco-Powered SD-WAN

    To Strengthen Its Role as a Key Partner in Supporting Business Growth e& Business Signs Five Strategic Partnerships to Provide Comprehensive Solutions for the Business Sector in the Egyptian Market

    Digital Partnerships at the Centre of Discussions at GSMA M360 MENA 2024

    Secure Domains Launches Operations in the Middle East The company is the first GCC based vendor specialized in cloud-based DNS Security solutions

    During its participation in the “Cairo ICT’24” exhibition: E&Misr participates with innovative technologies and solutions to enhance technological transformation and signs a number of partnership agreements

    أخبار تهمك

    في إطار خطتها الاستراتيجية للتوسع TLD تطلق مشروع "KUKŪN" في مدينة "مستقبل سيتي" أول مدن شركة "ميدار" باستثمارات تصل إلى 3 مليارات جنيه

    هلال : "نتورك إنترناشونال" نخطط للاقامة مركز اقليمى لتطوير الحلول بالقاهرة وتقديم الاستشارات الفنية للعملاء

    مدير عام" SAP " مصر : نسعى لدعم المبتكرين..وتنمية القدرات التنافسية للمؤسسات

    "إي فاينانس" بالتعاون مع "دل تكنولوجيز" تطلق منصة سحابية جاهزة للذكاء الاصطناعي في مصر

    فى " Cairo ICT’24" : رئيس اورانج مصر سوق واعد ونتطلع لما سيقدم من خدمات الجيل الخامس

    خلال" وطن رقمي 8 " : غرفة التكنولوجيا " CIT " تطلق 3 مبادرات لرقمنة المصانع وتوظيف الكوادر التكنولوجية ومنصة" الكتالوج الإلكتروني"

    إختارنا لك

    أبل ترفع أسعار هواتف iPhone 15 Pro Max

    واتساب يطرح تحديث بتجديد تصميم التطبيق

    اللغة الإنجليزية للأطفال والتي ستعطي أفضل النتائج

    رانيا يوسف في وصله رقص تشعل مواقع التواصل

    كيف تتكيف الشبكات مع الظروف الاستثنائية القائمة

    ONPASSIVE Announced as Strategic Partner for the 26th Arab-African Investment and International Cooperation Exhibition and Conference

    أجندة أعمال

    الاكثر قراءة

    الإبداع طريقك للنجاح بالجامعات

    حمّل تطبيق Alamrakamy| عالم رقمي الآن

    تحميل

    متجر بلاى

    تحميل

    متجر أبل