Cybercriminal Campaign Spreads Infostealers, Highlighting Risks to Web3 Gaming

Insikt Group examines a large-scale Russian-language cybercrime operation using fake Web3 gaming initiatives to distribute malware designed to steal information from both macOS and Windows users. These Web3 games, which are based on blockchain technology, offer the potential for financial gains through cryptocurrency earnings.

Web of Deceit: The Rise of Imitation Web3 Gaming Scams and Malware Infections

The campaign involves creating imitation Web3 gaming projects with slight name and branding modifications to appear legitimate, along with fake social media accounts to bolster their authenticity. The main webpages of these projects offer downloads that, once installed, infect devices with various types of "infostealer" malware such as Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro, depending on the operating system.

Fraudulent Web3 gaming project status (Source: Recorded Future)

The campaign targets Web3 gamers, exploiting their potential lack of cyber hygiene in the pursuit of profits. It represents a significant cross-platform threat, utilizing a variety of malware to compromise users' systems. The threat actors have prepared a resilient infrastructure, allowing them to quickly adapt by rebranding or shifting focus upon detection. The report highlights the necessity of continuous vigilance and recommends that individuals and organizations adopt comprehensive mitigation strategies against these sophisticated phishing tactics.

Specific findings reveal that the malware versions, including AMOS, can infect both Intel and Apple M1 Macs, indicating a broad vulnerability among users. The primary goal appears to be the theft of cryptocurrency wallets, posing a significant risk to financial security. Despite potential mitigations like endpoint detection and antivirus software, the campaign's techniques remain effective, suggesting the need for broader defense measures. Artifacts within the HTML code hint at the Russian origin of the threat actors, though their exact location remains uncertain. The report underscores the critical need for awareness and education to prevent downloads from unverified sources, highlighting the risk of brand damage to legitimate Web3 gaming projects if such threats are not adequately addressed.

To read the entire analysis, click here to download the report as a PDF.

Appendix A — Indicators of Compromise

Domains: ai-zerolend[.]xyz argongame[.]com argongame[.]fun argongame[.]network argongame[.]xyz astration[.]io astrationgame[.]com astrationgame[.]io astrationplay[.]com astrationplay[.]io blastl2[.]net cosmicwayrb[.]org crypterium[.]world crypteriumplay[.]com crypteriumplay[.]io crypteriumworld[.]io dustfighter[.]io dustfighter[.]space dustfightergame[.]com dustoperation[.]xyz gameastration[.]com playastration[.]com playcrypterium[.]com playcrypterium[.]io testload[.]pythonanywhere[.]com vether-testers[.]org vether[.]org worldcrypterium[.]io IP Addresses: 5.42.64[.]83 5.42.65[.]55 5.42.65[.]102 5.42.65[.]106 5.42.65[.]107 5.42.66[.]22 5.42.67[.]1 31.31.196[.]178 31.31.196[.]161 82.115.223[.]26 89.105.201[.]132 144.76.184[.]11 193.163.7[.]160 File Hashes: 073d524d8fc005acc05162f2e8574688a076d7888ec180c0ff78cab09b92ce95 0d9877eefd26756e2ecee3d806d60cb72bcb33d880f06e2f0e12c7c85d963426 0ed67ebecabb5fd7c4d41e521054154dbda0712845cb6f1b5b403c9f4d71ed4a 434878a4416201b4f26d1414be9126ae562c9f5be3f65168e48c0e95560460ac 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062 56a11900f952776d17637e9186e3954739c0d9039bf7c0aa7605a00a61bd6543 63724fbab837988311a551d4d9540577f822e23c49864095f568324352c0d1fd 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a 7d35dd19ee508c74c159e82f99c0483114e9b5b30f9bc2bd41c37b83cfbcd92d 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825 8d7df60dd146ade3cef2bfb252dfe81139f0a756c2b9611aaa6a972424f8af85 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 b2e2859dd87628d046ac9da224b435d09dd856d9ad3ede926aa5e1dc9903ffe8 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a c299089aca754950f7427e6946a980cedfded633ab3d55ca0aa5313bb2cc316c ccd6375cd513412c28a4e8d0fdedf6603f49a4ac5cd34ddd53cc72f08209bd83 e1657101815c73d9efd1a35567e6da0e1b00f176ac7d5a8d3f88b06a5602c320 ea592d5ca0350a3e46e3de9c6add352cd923206d1dcc45244e7a0a3c049462a4 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa f5e3f5d769efc49879b640334d6919bdb5ba7cae403317c8bd79d042803e20ce f6893fba30db87c2415a1e44b1f03e5e57ac14f9dbd2c3b0c733692472f099fd fabfe1bcce7eade07a30ff7d073859e2a8654c41da1f784d3b58da40aaeef682

Appendix B — Mitre ATT&CK Techniques

Tactic: Technique	ATT&CK Code
Data Obfuscation	T1001
Data from Local System	T1005
Query Registry	T1012
Obfuscated Files or Information	T1027
Exfiltration Over C2 Channel	T1041
Scheduled Task/Job	T1053
Process Discovery	T1057
Command and Scripting Interpreter	T1059
Application Layer Protocol	T1071
System Information Discovery	T1082
Modify Registry	T1112
Data Encoding: Standard Encoding	T1132.001
Indirect Command Execution	T1202
User Execution	T1204
User Execution: Malicious Link	T1204.001
User Execution: Malicious File	T1204.002
Virtualization/Sandbox Evasion	T1497
Steal Web Session Cookie	T1539
Unsecured Credentials	T1552
Unsecured Credentials: Credentials in Files	T1552.001
Disable or Modify Tools	T1562.001
Phishing	T1566
Acquire Infrastructure: Domains	T1583.001
Acquire Infrastructure: Web Services	T1583.006
Acquire Infrastructure: Malvertising	T1583.008
Establish Accounts: Social Media Accounts	T1585.001
Develop Capabilities	T1587
Gather Victim Identity Information: Credentials	T1589.001
Gather Victim Host Information: Software	T1592.002
Financial Theft	T1657

Appendix C — Domain and IP Correlations

Domain	Created	IP Address	Server	Active
astration[.]io	2023-10-31	5.42.66[.]22	nginx/1.22.0	No
astrationplay[.]io	2024-01-20	5.42.66[.]22	Golfe2	No
astrationplay[.]com	2024-01-21	5.42.66[.]22	Golfe2	No
astrationgame[.]com	2024-02-07	5.42.66[.]22	nginx/1.22.0	No
astrationgame[.]io	2024-02-07	5.42.66[.]22	nginx/1.22.0	No
playastration[.]com	2024-02-08	5.42.66[.]22	nginx/1.22.0	No
gameastration[.]com	2024-02-12	5.42.66[.]22	nginx/1.22.0	Yes
dustfighter[.]io	2024-01-31	5.42.65[.]102	nginx/1.22.0	Yes
dustfighter[.]space	2024-02-22	5.42.65[.]102	N/A	No
dustfightergame[.]com	2024-02-26	CLOUDFLARE	CLOUDFLARE	Yes
dustoperation[.]xyz	2024-02-25	31.31.196[.]178	nginx	Yes
ai-zerolend[.]xyz	2024-02-23	31.31.196[.]161	N/A	No
cosmicwayrb[.]org	2023-10-27	CLOUDFLARE	CLOUDFLARE	Yes
argongame[.]com	2023-12-16	CLOUDFLARE	CLOUDFLARE	Yes
argongame[.]network	2024-02-04	CLOUDFLARE	CLOUDFLARE	Yes
argongame[.]fun	2024-02-04	CLOUDFLARE	CLOUDFLARE	No
argongame[.]xyz	2024-02-04	CLOUDFLARE	CLOUDFLARE	Yes
crypteriumplay[.]com	2023-09-09	5.42.67[.]1	nginx/1.22.0	No
playcrypterium[.]com	2023-09-19	5.42.67[.]1	nginx/1.22.0	No
playcrypterium[.]io	2023-10-11	5.42.67[.]1	nginx/1.22.0	No
worldcrypterium[.]io	2023-09-06	5.42.67[.]1	nginx/1.22.0	No
crypterium[.]world	2023-08-03	CLOUDFLARE	CLOUDFLARE	No
crypteriumworld[.]io	2023-08-28	5.42.64[.]83	nginx/1.22.0	No
crypteriumplay[.]io	2023-10-25	5.42.65[.]102	AliyunOSS	No
vether[.]org	2023-11-30	CLOUDFLARE	CLOUDFLARE	Yes
vether-testers[.]org	2024-01-30	82.115.223[.]26	nginx/1.20.2	Yes