![]() ![]() This is because the Operation NightScout instead focused on gaming community targets, a somewhat peculiar and rarely seen way of collecting info in a highly targeted cyberespionage operation. While ESET uncovered other supply-chain attacks last year, such as Operation StealthyTrident targeting Able Desktop users, WIZVERA VeraPort banking and government targets, and Operation SignSight which led to the compromise of Vietnamese government signing software, Nightscout it's somewhat of a different beast. The malicious updates delivered through NoxPlayer's compromised update mechanism included an unknown malware with monitoring capabilities and the extensively used Gh0st remote access trojan (RAT).Ī third malware, the PoisonIvy RAT, was also discovered by ESET while investigating the supply-chain attack but this was delivered as a second-stage payload, from the attackers' own infrastructure not by deploying malicious NoxPlayer updates.ĭespite the vast amount of victims that could've been infected between September 2020 when the supply-chain attack started and January 2021 when it was discovered, the NightScout threat actor instead chose to infect five targets from Taiwan, Hong Kong, and Sri Lanka, revealing this operation's highly-targeted nature. In some cases, additional payloads were downloaded by the BigNox updater from attacker-controlled servers," ESET researcher Ignacio Sanmillan said. "We have sufficient evidence to state that BigNox’s infrastructure was compromised to host malware and also to suggest that their API infrastructure could have been compromised. To deliver the malicious payload on their targets' systems, the hacker group behind the operation dubbed NightScout compromised BigNox's storage infrastructure to store the malware and the API infrastructure to deploy the payloads. NoxPlayer is used by gamers from over 150 countries around the globe according to BigNox but, as ESET found in January 2021, the supply-chain attack was focused on infecting only Asian gamers with at least three different malware strains. ![]() Until today, and based on its own telemetry, ESET said it spotted malware-laced NoxPlayer updates being delivered to only five victims, located in Taiwan, Hong Kong, and Sri Lanka.ĮSET has released today a report with technical details for NoxPlayers to determine if they received a malware-laced update and how to remove the malware.Ī BigNox spokesperson did not return a request for comment.Īndroid emulator supply-chain attack targets gamers with malwareĮSET researchers have discovered that the updating mechanism of NoxPlayer, an Android emulator for Windows and macOS, made by Hong Kong-based company BigNox, was compromised by an unknown threat actor and used to infect gamers with malware. Despite evidence implying that attackers had access to BigNox servers since at least September 2020, ESET said the threat actor didn't target all of the company's users but instead focused on specific machines, suggesting this was a highly-targeted attack looking to infect only a certain class of users. "Three different malware families were spotted being distributed from tailored malicious updates toselected victims, with no sign of leveraging any financial gain, but rather surveillance-related capabilities," ESET said in a report shared today with ZDNet. Using this access, hackers tampered with the download URL of NoxPlayer updates in the API server in order to deliver malware to NoxPlayer users. ESET says that based on evidence its researchers gathered, a threat actor compromised one of the company's official API () and file-hosting servers (). The attack was discovered by Slovak security firm ESET on January 25, last week, and targeted BigNox, a company that makes NoxPlayer, a software client for emulating Android apps on Windows or macOS desktops. A mysterious hacking group has compromised the server infrastructure of a popular Android emulator and has delivered malware to a handful of victims across Asia in a highly-targeted supply chain attack. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |