Battle Metropolis, colloquially generally known as “that tank recreation”, is an emblem of a bygone period. Some 30 years in the past, avid gamers would pop a cartridge into their console, settle in entrance of a cumbersome TV, and obliterate waves of enemy tanks till the display screen gave out.
Immediately, the world’s a unique place, however tank video games stay widespread. Fashionable iterations supply avid gamers not simply the fun of gameplay but additionally the prospect to earn NFTs. Cybercriminals too have one thing to supply: a classy assault focusing on crypto-gaming lovers.
Backdoor and zero-day exploit in Google Chrome
This story begins in February 2024, when our safety resolution detected the Manuscrypt backdoor on a person’s laptop in Russia. We’re very conversant in this backdoor; varied variations of it have been utilized by the Lazarus APT group since at the very least 2013. So, given we already know the primary instrument and strategies utilized by the attackers — what’s so particular about this specific incident?
The factor is that these hackers usually goal massive organizations like banks, IT firms, universities, and even authorities companies. However this time, Lazarus hit a person person, planting a backdoor on a private laptop! The cybercriminals lured the sufferer to a recreation web site and thereby gained full entry to their system. Three issues made this attainable:
- The sufferer’s irresistible need to play their favourite tank recreation in a brand new format
- A zero-day vulnerability in Google Chrome
- An exploit that allowed distant code execution within the Google Chrome course of
Earlier than you begin to fear, loosen up: Google has since launched a browser replace, blocked the tank recreation’s web site, and thanked the Kaspersky safety researchers. However simply in case, our merchandise detect each the Manuscrypt backdoor and the exploit. We’ve delved into the small print of this story on the Securelist weblog.
Pretend accounts
Initially of the investigation, we thought the group had gone to extraordinary lengths this time: “Did they really create a whole recreation only for a rip-off?” However we quickly labored out what they’d actually accomplished. The cybercriminals primarily based their recreation — DeTankZone — on the present recreation DeFiTankLand. They actually went all out, stealing the supply code of DeFiTankLand and creating faux social media accounts for his or her counterfeit.
Across the similar time, in March 2024, the value of the DefitankLand (sic) cryptocurrency plummeted — the builders of the unique recreation introduced that their chilly pockets had been hacked, and “somebody” had stolen $20,000. The identification of this “somebody” stays a thriller. The builders consider it was an insider, however we suspect that the ever-present tentacles of Lazarus are concerned.
Variations between the faux and the unique are minimal
The cybercriminals orchestrated a full-blown promotion marketing campaign for his or her recreation: they boosted follower counts on X (previously Twitter), despatched collaboration affords to lots of of cryptocurrency influencers (additionally potential victims), created premium LinkedIn accounts, and arranged waves of phishing emails. In consequence, the faux recreation obtained much more traction than the unique (6000 followers on X, versus 5000 for the unique recreation’s account).
Social media content material created by AI with the assistance of graphic designers
How we performed tanks
Now for probably the most enjoyable half…
The malicious web site that Lazarus lured their victims to supplied an opportunity, not solely to “check out” a zero-day browser exploit, but additionally to play a beta model of the sport. Now, right here at Kaspersky, we respect the classics, so we couldn’t resist having a go on this promising new model. We downloaded an archive that appeared fully official: 400MB in dimension, right file construction, logos, UI components, and 3D mannequin textures. Boot her up!
The DeTankZone begin menu greeted us with a immediate to enter an e-mail deal with and password. We first tried logging in utilizing frequent passwords like “12345” and “password” however that doesn’t work. “Positive, then”, we predict. “We’ll simply register a brand new account”. Once more, no luck — the system wouldn’t allow us to play.
The beginning menu conjures up confidence with a seemingly official login kind
So why have been there 3D mannequin textures and different recordsdata within the recreation archive? Might they actually have been different parts of the malware? Really, it wasn’t that dangerous. We reverse-engineered the code and found components answerable for the connection to the sport server — which, for this faux model, was non-functional. So, in principle, the sport was nonetheless playable. A little bit of time spent, a bit programming, and voilà — we exchange the hackers’ server with our personal, and the pink tank “Boris” enters the world.
The sport reminded us of shareware video games from 20 years in the past — which made all the hassle worthwhile
Classes from this assault
The important thing takeaway right here is that even seemingly innocent internet hyperlinks can find yourself along with your complete laptop being hijacked. Cybercriminals are consistently refining their ways and strategies. Lazarus is already utilizing generative AI with some success, which means we will anticipate much more refined assaults involving it sooner or later.
Safety options are additionally evolving with efficient integration of AI — be taught extra right here and right here. All abnormal web customers need to do is be certain that their units are protected, and keep knowledgeable in regards to the newest scams. Luckily, the Kaspersky Day by day weblog makes this straightforward — subscribe to remain up to date…
