Research (Insikt)

Cybercriminal Campaign Spreads Infostealers, Highlighting Risks to Web3 Gaming

Posted: 11th April 2024
By: Insikt Group®

insikt-group-logo-updated-3-300x48.png

Insikt Group examines a large-scale Russian-language cybercrime operation using fake Web3 gaming initiatives to distribute malware designed to steal information from both macOS and Windows users. These Web3 games, which are based on blockchain technology, offer the potential for financial gains through cryptocurrency earnings.

Web of Deceit: The Rise of Imitation Web3 Gaming Scams and Malware Infections

The campaign involves creating imitation Web3 gaming projects with slight name and branding modifications to appear legitimate, along with fake social media accounts to bolster their authenticity. The main webpages of these projects offer downloads that, once installed, infect devices with various types of "infostealer" malware such as Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro, depending on the operating system.

Fraudulent Web3 gaming project status (Source: Recorded Future) Fraudulent Web3 gaming project status (Source: Recorded Future)

The campaign targets Web3 gamers, exploiting their potential lack of cyber hygiene in the pursuit of profits. It represents a significant cross-platform threat, utilizing a variety of malware to compromise users' systems. The threat actors have prepared a resilient infrastructure, allowing them to quickly adapt by rebranding or shifting focus upon detection. The report highlights the necessity of continuous vigilance and recommends that individuals and organizations adopt comprehensive mitigation strategies against these sophisticated phishing tactics.

Specific findings reveal that the malware versions, including AMOS, can infect both Intel and Apple M1 Macs, indicating a broad vulnerability among users. The primary goal appears to be the theft of cryptocurrency wallets, posing a significant risk to financial security. Despite potential mitigations like endpoint detection and antivirus software, the campaign's techniques remain effective, suggesting the need for broader defense measures. Artifacts within the HTML code hint at the Russian origin of the threat actors, though their exact location remains uncertain. The report underscores the critical need for awareness and education to prevent downloads from unverified sources, highlighting the risk of brand damage to legitimate Web3 gaming projects if such threats are not adequately addressed.

To read the entire analysis, click here to download the report as a PDF.

Appendix A — Indicators of Compromise

Domains:
ai-zerolend[.]xyz
argongame[.]com
argongame[.]fun
argongame[.]network
argongame[.]xyz
astration[.]io
astrationgame[.]com
astrationgame[.]io
astrationplay[.]com
astrationplay[.]io
blastl2[.]net
cosmicwayrb[.]org
crypterium[.]world
crypteriumplay[.]com
crypteriumplay[.]io
crypteriumworld[.]io
dustfighter[.]io
dustfighter[.]space
dustfightergame[.]com
dustoperation[.]xyz
gameastration[.]com
playastration[.]com
playcrypterium[.]com
playcrypterium[.]io
testload[.]pythonanywhere[.]com
vether-testers[.]org
vether[.]org
worldcrypterium[.]io


IP Addresses:
5.42.64[.]83
5.42.65[.]55
5.42.65[.]102
5.42.65[.]106
5.42.65[.]107
5.42.66[.]22
5.42.67[.]1
31.31.196[.]178
31.31.196[.]161
82.115.223[.]26
89.105.201[.]132
144.76.184[.]11
193.163.7[.]160


File Hashes:
073d524d8fc005acc05162f2e8574688a076d7888ec180c0ff78cab09b92ce95
0d9877eefd26756e2ecee3d806d60cb72bcb33d880f06e2f0e12c7c85d963426
0ed67ebecabb5fd7c4d41e521054154dbda0712845cb6f1b5b403c9f4d71ed4a
434878a4416201b4f26d1414be9126ae562c9f5be3f65168e48c0e95560460ac
4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
56a11900f952776d17637e9186e3954739c0d9039bf7c0aa7605a00a61bd6543
63724fbab837988311a551d4d9540577f822e23c49864095f568324352c0d1fd
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
7d35dd19ee508c74c159e82f99c0483114e9b5b30f9bc2bd41c37b83cfbcd92d
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
8d7df60dd146ade3cef2bfb252dfe81139f0a756c2b9611aaa6a972424f8af85
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
b2e2859dd87628d046ac9da224b435d09dd856d9ad3ede926aa5e1dc9903ffe8
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
c299089aca754950f7427e6946a980cedfded633ab3d55ca0aa5313bb2cc316c
ccd6375cd513412c28a4e8d0fdedf6603f49a4ac5cd34ddd53cc72f08209bd83
e1657101815c73d9efd1a35567e6da0e1b00f176ac7d5a8d3f88b06a5602c320
ea592d5ca0350a3e46e3de9c6add352cd923206d1dcc45244e7a0a3c049462a4
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
f5e3f5d769efc49879b640334d6919bdb5ba7cae403317c8bd79d042803e20ce
f6893fba30db87c2415a1e44b1f03e5e57ac14f9dbd2c3b0c733692472f099fd
fabfe1bcce7eade07a30ff7d073859e2a8654c41da1f784d3b58da40aaeef682


Appendix B — Mitre ATT&CK Techniques

Tactic: Technique ATT&CK Code
Data Obfuscation T1001
Data from Local System T1005
Query Registry T1012
Obfuscated Files or Information T1027
Exfiltration Over C2 Channel T1041
Scheduled Task/Job T1053
Process Discovery T1057
Command and Scripting Interpreter T1059
Application Layer Protocol T1071
System Information Discovery T1082
Modify Registry T1112
Data Encoding: Standard Encoding T1132.001
Indirect Command Execution T1202
User Execution T1204
User Execution: Malicious Link T1204.001
User Execution: Malicious File T1204.002
Virtualization/Sandbox Evasion T1497
Steal Web Session Cookie T1539
Unsecured Credentials T1552
Unsecured Credentials: Credentials in Files T1552.001
Disable or Modify Tools T1562.001
Phishing T1566
Acquire Infrastructure: Domains T1583.001
Acquire Infrastructure: Web Services T1583.006
Acquire Infrastructure: Malvertising T1583.008
Establish Accounts: Social Media Accounts T1585.001
Develop Capabilities T1587
Gather Victim Identity Information: Credentials T1589.001
Gather Victim Host Information: Software T1592.002
Financial Theft T1657



Appendix C — Domain and IP Correlations

Domain Created IP Address Server Active
astration[.]io 2023-10-31 5.42.66[.]22 nginx/1.22.0 No
astrationplay[.]io 2024-01-20 5.42.66[.]22 Golfe2 No
astrationplay[.]com 2024-01-21 5.42.66[.]22 Golfe2 No
astrationgame[.]com 2024-02-07 5.42.66[.]22 nginx/1.22.0 No
astrationgame[.]io 2024-02-07 5.42.66[.]22 nginx/1.22.0 No
playastration[.]com 2024-02-08 5.42.66[.]22 nginx/1.22.0 No
gameastration[.]com 2024-02-12 5.42.66[.]22 nginx/1.22.0 Yes
dustfighter[.]io 2024-01-31 5.42.65[.]102 nginx/1.22.0 Yes
dustfighter[.]space 2024-02-22 5.42.65[.]102 N/A No
dustfightergame[.]com 2024-02-26 CLOUDFLARE CLOUDFLARE Yes
dustoperation[.]xyz 2024-02-25 31.31.196[.]178 nginx Yes
ai-zerolend[.]xyz 2024-02-23 31.31.196[.]161 N/A No
cosmicwayrb[.]org 2023-10-27 CLOUDFLARE CLOUDFLARE Yes
argongame[.]com 2023-12-16 CLOUDFLARE CLOUDFLARE Yes
argongame[.]network 2024-02-04 CLOUDFLARE CLOUDFLARE Yes
argongame[.]fun 2024-02-04 CLOUDFLARE CLOUDFLARE No
argongame[.]xyz 2024-02-04 CLOUDFLARE CLOUDFLARE Yes
crypteriumplay[.]com 2023-09-09 5.42.67[.]1 nginx/1.22.0 No
playcrypterium[.]com 2023-09-19 5.42.67[.]1 nginx/1.22.0 No
playcrypterium[.]io 2023-10-11 5.42.67[.]1 nginx/1.22.0 No
worldcrypterium[.]io 2023-09-06 5.42.67[.]1 nginx/1.22.0 No
crypterium[.]world 2023-08-03 CLOUDFLARE CLOUDFLARE No
crypteriumworld[.]io 2023-08-28 5.42.64[.]83 nginx/1.22.0 No
crypteriumplay[.]io 2023-10-25 5.42.65[.]102 AliyunOSS No
vether[.]org 2023-11-30 CLOUDFLARE CLOUDFLARE Yes
vether-testers[.]org 2024-01-30 82.115.223[.]26 nginx/1.20.2 Yes

Related