Experts Warn of ‘Ice Breaker’ Cyberattacks Targeting Gaming and Gambling Industry

Feb 01, 2023Ravie LakshmananGaming / Cyber Attack

A new attack campaign has targeted the gaming and gambling
sectors since at least September 2022, just months prior to the
ICE London
2023^[1] gaming industry trade
fair event that’s scheduled next week.

Israeli cybersecurity company Security Joes is tracking
the activity cluster under the name Ice Breaker,
stating the intrusions employ clever social engineering tactics to
deploy a JavaScript backdoor.

The attack sequence proceeds as follows: The threat actor poses
as a customer while initiating a conversation with a support agent
of a gaming website and urges the individual on the other end to
open a screenshot image hosted on Dropbox.

Security Joes said^[2]
that the threat actor is “well-aware of the fact that the customer
service is human-operated.”

Clicking the malicious link sent in the chat leads to the
retrieval of an LNK payload or, alternatively, a VBScript file as a
backup option, the former of which is configured to download and
run an MSI package containing a Node.js implant.

The JavaScript file has all the features of a typical backdoor,
enabling the threat actor to enumerate running processes, steal
passwords and cookies, exfiltrate arbitrary files, take
screenshots, run VBScript imported from a remote server, and even
open a reverse proxy on the compromised host.

Should the VBS downloader be executed by the victim, the
infection culminates in the deployment of Houdini^[3], a VBS-based remote
access trojan that dates back to 2013.

The threat actors’ origins are currently unknown, although they
have been observed using broken English during their conversations
with customer service agents. Some indicators of compromise (IoCs)
associated with the campaign were previously shared^[4]
by the MalwareHunterTeam in October 2022.

“This is a highly effective attack vector for the gaming and
gambling industry,” Felipe Duarte, senior threat researcher at
Security Joes, said.

“The never-seen-before compiled JavaScript second stage malware
is highly complex to dissect, showing that we are dealing with a
skilled threat actor with the potential of being sponsored by an
interest owner.”