It is not currently clear why NightScout conducted an espionage operation targeting the gaming community. Interestingly, it appears that NightScout only infected five NoxPlayer users with a malicious update, based in Taiwan, Hong Kong, and Sri Lanka.Īlthough targeted cyberattacks are not unusual, they are more commonly used to target government officials or high-profile businessmen. NightScout also delivered a second-stage payload, the PoisonIvy RAT, but from their own infrastructure rather than using compromised NoxPlayer updates. The first has not been documented before, while the second was a variant of the Ghost remote access trojan (RAT). When unsuspecting NoxPlayer users downloaded an update, they were unknowingly downloading multiple malware strains with surveillance-related capabilities. Also, check out our roundup of the best malware removal tools.These are the best identity theft protection services on the market In order to understand the dynamics of this supply-chain attack, it’s important to know what vector was used in order to deliver malware to NoxPlayer users.NoxPlayer emulates Android apps on Windows or macOS desktops. The attack targeted BigNox, the company that creates NoxPlayer. A handful of victims across Asia were targeted in a supply chain attack, leaving malware on their device. We've built a list of the best Android antivirus apps around A popular Android emulator has been compromised by a mysterious hacking group.It is unclear if the NoxPlayer compromise is the work of a state-sponsored group or a financially-motivated group looking to compromise game developers.ĮSET did, however, point out that the three malware strains deployed via malicious NoxPlayer updates had "similarities" with other malware strains used in a Myanmar presidential office website supply-chain compromise in 2018 and in early 2020 in an intrusion into a Hong Kong university. The second is the case of the VGCA, the official certificate authority of the Vietnamese government.ĮSET researchers did not formally link this incident to a well-known hacking group. The first is the case of Able Desktop, software used by many Mongolian government agencies. This incident is also the third supply chain attack discovered by ESET over the past two months. Until today, and based on its own telemetry, ESET said it spotted malware-laced NoxPlayer updates being delivered to only five victims, located in Taiwan, Hong Kong, and Sri Lanka.ĮSET has released today a report with technical details for NoxPlayers to determine if they received a malware-laced update and how to remove the malware.Ī BigNox spokesperson did not return a request for comment. "Three different malware families were spotted being distributed from tailored malicious updates toselected victims, with no sign of leveraging any financial gain, but rather surveillance-related capabilities," ESET said in a report shared today with ZDNet.ĭespite evidence implying that attackers had access to BigNox servers since at least September 2020, ESET said the threat actor didn't target all of the company's users but instead focused on specific machines, suggesting this was a highly-targeted attack looking to infect only a certain class of users. Using this access, hackers tampered with the download URL of NoxPlayer updates in the API server in order to deliver malware to NoxPlayer users. article/hacker-group-inserted-malware-in-noxplayer-android-emulator/. The attack was discovered by Slovak security firm ESET on January 25, last week, and targeted BigNox, a company that makes NoxPlayer, a software client for emulating Android apps on Windows or macOS desktops.ĮSET says that based on evidence its researchers gathered, a threat actor compromised one of the company's official API () and file-hosting servers (). The attackers put the malware-infested app on 3rd Party stores to take. Only five detected until now, in countries such as Taiwan, Hong Kong, and Sri Lanka.īy Catalin Cimpanu for Zero Day | Febru- 10:30 GMT (10:30 GMT) | Topic: SecurityĪ mysterious hacking group has compromised the server infrastructure of a popular Android emulator and has delivered malware to a handful of victims across Asia in a highly-targeted supply chain attack. Attackers targeted only a handful of victims.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |