Hackers target gamers with a supply-chain attack

Cyber criminals have compromised an Android emulator and used it to infect gamers’ devices with malware

Security researchers have discovered hackers have compromised an Android emulator and used it to infect gamers’ devices with malware.

According to researchers at ESET, a new supply-chain attack compromising the update mechanism of NoxPlayer, an Android emulator that helps 150 million users worldwide play mobile games on their PCs and Macs, was discovered late last month.

Currently, the supply-chain attack has infected gamers in Asia with three malware strains. There is no sign of hackers using the malware for financial gain, but researchers have discovered hackers are using the malware for surveillance.

The company behind NoxPlayer is Hong Kong-based BigNox, and NightScout is the cyber criminal group initiating the attacks. Security researchers said hackers compromised BigNox's res06.bignox.com storage servers and abused the api.bignox.com API infrastructure to install payloads. 

As of this writing, BigNox has denied being affected by the intrusion.

Researchers discovered indicators of compromise in September 2020, but it wasn’t until January 25 that they uncovered explicitly malicious activity. They immediately reported the malicious activity to BigNox.

“We have sufficient evidence to state that the BigNox infrastructure (res06.bignox.com) was compromised to host malware, and to suggest that their HTTP API infrastructure (api.bignox.com) could have been compromised. In some cases, additional payloads were downloaded by the BigNox updater from attacker-controlled servers,” researchers said.

According to further investigations, researchers said that out of the 100,000 of its users that also had NoxPlayer installed, only five received a malicious update. They said this showed that “Operation NightScout” as they called it, was a “highly targeted operation.” 

Victims are based in Taiwan, Hong Kong, and Sri Lanka. Researchers have not yet found any evidence of affected gamers in the US.

“We were unsuccessful in finding correlations that would suggest any relationships among victims. However, based on the compromised software in question and the delivered malware exhibiting surveillance capabilities, we believe this may indicate the intent of collecting intelligence on targets somehow involved in the gaming community,” said researchers.

Researchers said that gamers should “perform a standard reinstall from clean media” in case of intrusion.

“For non-compromised users: do not download any updates until BigNox notifies that it has mitigated the threat,” added researchers.

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Recommended

Dual citizen sentenced to 11 years for role in North Korean crypto hacking scheme
hacking

Dual citizen sentenced to 11 years for role in North Korean crypto hacking scheme

10 Sep 2021
IoT devices are more vulnerable than ever
Internet of Things (IoT)

IoT devices are more vulnerable than ever

10 Sep 2021
DOJ extradites Ukrainian man who used a botnet to decrypt login credentials
botnets

DOJ extradites Ukrainian man who used a botnet to decrypt login credentials

9 Sep 2021
Hackers use open source tools to steal usernames and passwords
open source

Hackers use open source tools to steal usernames and passwords

8 Sep 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Apple patches zero-day flaw abused by infamous NSO exploit
exploits

Apple patches zero-day flaw abused by infamous NSO exploit

14 Sep 2021
Hackers develop Linux port of Cobalt Strike for new attacks
Security

Hackers develop Linux port of Cobalt Strike for new attacks

14 Sep 2021