Chinese Hackers Targeting Online Casinos with GamePlayerFramework Malware

An advanced persistent risk (APT) team of Chinese origin codenamed DiceyF has been joined to a string of attacks aimed at on-line casinos in Southeast Asia for decades.

Russian cybersecurity company Kaspersky said the activity aligns with a further established of intrusions attributed to Earth Berberoka (aka GamblingPuppet) and DRBControl, citing tactical and focusing on similarities as nicely as the abuse of secure messaging shoppers.

“Possibly we have a blend of espionage and [intellectual property] theft, but the real motivations continue being a thriller,” scientists Kurt Baumgartner and Georgy Kucherin claimed in a specialized publish-up posted this 7 days.

The beginning stage of the investigation was in November 2021 when Kaspersky stated it detected a number of PlugX loaders and other payloads that have been deployed by way of an employee monitoring support and a security package deal deployment service.

The initial infection system – the distribution of the framework by means of security option deals – afforded the risk actor “to complete cyberespionage things to do with some degree of stealth,” the company mentioned.

Subsequently, the very same security bundle deployment company is explained to have been used to provide what is identified as the GamePlayerFramework, a C# variant of a C++-dependent malware recognised as PuppetLoader.

“This ‘framework’ involves downloaders, launchers, and a established of plugins that give distant accessibility and steal keystrokes and clipboard details,” the scientists spelled out.

Indications are that the DiceyF exercise is a observe-on campaign to Earth Berberoka with a retooled malware toolset, even as the framework is managed through two separate branches dubbed Tifa and Yuna, which arrive with different modules of different levels of sophistication.

Although the Tifa department has a downloader and a main component, Yuna is extra intricate in terms of performance, incorporating a downloader, a set of plugins, and at minimum 12 PuppetLoader modules. That reported, each branches are thought to be actively and incrementally up to date.

Irrespective of the variant employed, the GamePlayerFramework, at the time launched, connects to a command-and-handle (C2) and transmits facts about the compromised host and the clipboard contents, right after which the C2 responds with 1 of 15 instructions that let the malware to seize command of the device.

This also includes launching a plugin on the sufferer process that can either be downloaded from the C2 server when the framework is instantiated or retrieved utilizing the “InstallPlugin” command despatched by the server.

These plugins, in flip, make it attainable to steal cookies from Google Chrome and Mozilla Firefox browsers, capture keystroke and clipboard knowledge, set up virtual desktop classes, and even remotely join to the equipment more than SSH.

Kaspersky also pointed to the use of a malicious app that mimics an additional software program known as Mango Worker Account Knowledge Synchronizer, a messenger app applied at the qualified entities, to fall the GamePlayerFramework within just the network.

“There are numerous interesting qualities of DiceyF campaigns and TTPs,” the scientists stated. “The group modifies their codebase over time, and develops performance in the code during their intrusions.”

“To make positive that victims did not become suspicious of the disguised implants, attackers received information about targeted businesses (these as the ground in which the organization’s IT section is found) and provided it inside graphic windows exhibited to victims.”

Found this posting fascinating? Comply with THN on Facebook, Twitter  and LinkedIn to read far more unique material we post.

Some parts of this article are sourced from:
thehackernews.com