FlagThis

A global attack campaign named StaryDobry has been discovered, utilizing trojanized game installers to deploy the XMRig cryptocurrency miner on compromised Windows systems. Attackers uploaded poisoned installers for popular games such as BeamNG.drive, Garry's Mod, and Dyson Sphere Program to torrent sites, luring users into downloading them. Once executed, these installers initiate a complex infection chain, ultimately leading to the installation of the XMRig miner. The campaign, detected by Kaspersky on December 31, 2024, lasted for a month and has primarily targeted individual users and businesses.

Researchers have identified that the attack chain employs several evasion techniques, including anti-debugging checks and geolocation verification. The malware gathers a fingerprint of the machine, decrypts an executable, and modifies Windows Shell Extension Thumbnail Handler functionality. The campaign focused on gaming PCs with 8+ core CPUs to maximize mining efficiency. While the perpetrators remain unknown, the presence of Russian language strings suggests the involvement of Russian-speaking actors. The most affected countries included Russia, Brazil, Germany, Belarus, and Kazakhstan.

ImgSrc: securityonline.info

References:

• securityonline.info - Cracked Games, Cryptojacked PCs: The StaryDobry Campaign - 1d
• The Hacker News - Trojanized Game Installers Deploy Cryptocurrency Miner in Large-Scale StaryDobry Attack - 1d
• SCM feed for Threat Management - Global XMRig attack campaign involves trojanized game installers - 1d
• Talkback Resources - Trojanized Game Installers Deploy Cryptocurrency Miner in Large-Scale StaryDobry Attack [net] [sys] [mal] - 1d
• Talkback Resources - Cracked Games, Cryptojacked PCs: The StaryDobry Campaign [net] [mal] - 1d
• Talkback Resources - StaryDobry campaign targets gamers with XMRig miner [mal] - 1d
• GBHackers Security | #1 Globally Trusted Cyber Security News Platform - A sophisticated malware campaign was launched by cybercriminals, targeting users through trojanized versions of popular games. - 20h
• @BleepingComputer - A large-scale malware campaign dubbed StaryDobry has been targeting gamers worldwide with trojanized versions of cracked games such as Garry's Mod, BeamNG.drive, and Dyson Sphere Program. - 20h
• Malware Archives ? Cybersecurity News - Cybercriminals launched a mass infection campaign, dubbed StaryDobry, leveraging the holiday season’s increased torrent traffic The - 18h
• www.bleepingcomputer.com - A large-scale malware campaign dubbed "StaryDobry" has been targeting gamers worldwide with trojanized versions of cracked games such as Garry's Mod, BeamNG.drive, and Dyson Sphere Program. - 18h
• @youranonriots - A large-scale malware campaign dubbed "StaryDobry" has been targeting gamers worldwide with trojanized versions of cracked games such as Garry's Mod, BeamNG.drive, and Dyson Sphere Program. - 15h

Classification:

• HashTags: Malware Cryptomining Trojan
• Company: Cracked game users
• Target: Gamers
• Attacker: Kaspersky
• Product: Games
• Feature: cryptocurrency mining
• Type: Malware
• Severity: Medium