Kaspersky Lab Analyzes Active Cyberespionage Campaign

huddhabib

Kaspersky Lab Analyzes Active Cyberespionage Campaign Targeting Online Gaming CompaniesWorldwide

Today Kaspersky Lab’s team ofexperts published a detailed research report that analyzes a sustainedcyberespionage campaign conducted by the cybercriminal organization known as“Winnti.”

According to Kaspersky Lab’sreport, the Winnti group has been attacking companies in the online gamingindustry since 2009 and is currently still active. The group’s objectives arestealing digital certificates signed by legitimate software vendors in additionto intellectual property theft, including the source code of online gameprojects.

The first incident that drewattention to the Winnti group’s malicious activities occurred in the autumn of2011, when a malicious Trojan was detected on a large number of end-usercomputers across the globe. The clear link between all of the infectedcomputers is that that they were used to play a popular online game. Shortlyafter the incident, details emerged that the malicious program which hadinfected the users’ computers was part of a regular update  from the  gaming  company’s official  server.  Infected users  and  members of  the gaming community suspectedthe computer game publisher was installing the malware to spy  on its  customers.  However, it  later  became clear  that  the malicious  program  was installed on the players’ computers byaccident, and that the cybercriminals were actually targeting the computer gamecompany itself.

In response, the computer gamepublisher that owned the servers which spread the Trojan to its users askedKaspersky Lab to analyze the malicious program. The Trojan turned out to be aDLL library compiled for a 64-bit Windows environment and used a properlysigned malicious drive. It was a fully functionally Remote Administration Tool(RAT), which gives attackers  the  ability to  control  a victim’s  computer  without the  user’s  knowledge. Th e fi n d i n g  w a s s i g n i fi c a n t  a s  th i s T ro j a n  w a s  th e fi rs t  m a l i c i o u s  p ro g ra m o n  a

64 - bi t v e r s i o n o f M i cr o s o f t W i nd o w s 7 t ha t ha d a v a l i d d i g i t a l s i g na t u re .

Kaspersky Lab’s experts begananalyzing the Winnti group’s campaign and found that more than 30 companies inthe online gaming industry had been infected by the Winnti group, with themajority being software development companies producing online video games inSouth East Asia. However, online gaming companies located in Germany, theUnited States, Japan, China, Russia, Brazil, Peru, and Belarus were alsoidentified as victims of the Winnti group.

In addition to industrialespionage, Kaspersky Lab’s experts have identified three main monetizationschemes that could be used by the Winnti group to generate an illegal profit:

•             Manipulatethe accumulation of in-game currency, such as “runes” or “gold” that’s used byplayers and convert the accumulated virtual money into real money;

•             Usethe stolen source code from online game servers to search forvulnerabilities  inside games   to  augment   and   accelerate  the   manipulation   of  in-game   currency   and  its accumulation without suspicion;

•             Usethe stolen source code from servers of popular online games in order to deploytheir

own pirated servers.

Currently the Winnti group isstill active and Kaspersky Lab’s investigation is ongoing. The company’s  team of  experts  has been  diligently  working with  the  IT security  community, online  gaming industry  and  certificate authorities  to  identify additional  infected  servers while assisting with the revocationof stolen digital certificates.

To  read Kaspersky  Lab’s  research post  and  the full  report  about the  Winnti  group’s campaign,    including   a    complete    technical   analysis    of    the   investigation,    please visitSecurelist.

Kaspersky  Lab’s products  detect and neutralize  the malicious programs  and its variantsused        by        the        Winnti        group,        classified        asBa c k d o o r . W i n 32. W i n n ti , Ba c k d o o r . W i n 64. W i n n t i , R o o t k i t . W i n 32. W i n nt i a n d R o o t k i t . W i n 64. W i n nt i .