Experts Warn of 'Ice Breaker' Cyberattacks Targeting Gaming and Gambling Industry

guest · Feb 1, 2023

By Ravie Lakshmanan - February 1, 2023

A new attack campaign has targeted the gaming and gambling sectors since at least September 2022, just months prior to the ICE London 2023 gaming industry trade fair event that's scheduled next week.
Click to expand...

Israeli cybersecurity company Security Joes is tracking the activity cluster under the name Ice Breaker, stating the intrusions employ clever social engineering tactics to deploy a JavaScript backdoor.

The attack sequence proceeds as follows: The threat actor poses as a customer while initiating a conversation with a support agent of a gaming website and urges the individual on the other end to open a screenshot image hosted on Dropbox.
Click to expand...

Security Joes said that the threat actor is "well-aware of the fact that the customer service is human-operated."
Click to expand...

Clicking the malicious link sent in the chat leads to the retrieval of an LNK payload or, alternatively, a VBScript file as a backup option, the former of which is configured to download and run an MSI package containing a Node.js implant.

The JavaScript file has all the features of a typical backdoor, enabling the threat actor to enumerate running processes, steal passwords and cookies, exfiltrate arbitrary files, take screenshots, run VBScript imported from a remote server, and even open a reverse proxy on the compromised host.

"This is a highly effective attack vector for the gaming and gambling industry," Felipe Duarte, senior threat researcher at Security Joes, said.
"The never-seen-before compiled JavaScript second stage malware is highly complex to dissect, showing that we are dealing with a skilled threat actor with the potential of being sponsored by an interest owner."
Click to expand...

Security Joes: Operation Ice Breaker Targets The Gam(bl)ing Industry Right Before It's Biggest Gathering

In September of last year, our Incident Response team was called to an incident that was identified as an attempt of social engineering an online customer service platform. Due to custom-built rules and extensive employee awareness training, we were able to push back these threats.

Since this is a new threat actor, we are tracking it as Ice Breaker APT. Although research is still ongoing, we are releasing this article to reveal the attacker's Modus Operandi, attack chain, ways to mitigate the threat and supported IOCs, TTPs and Yara.

"Ice Breaker is using a very specific social engineering technique that somewhat sacrifices their identity", said Senior Threat Researcher, Felipe Duarte.
Click to expand...

Log in or Sign up

Experts Warn of 'Ice Breaker' Cyberattacks Targeting Gaming and Gambling Industry

guest Guest

Log in or Sign up

Experts Warn of 'Ice Breaker' Cyberattacks Targeting Gaming and Gambling Industry

guest Guest

Useful Searches