As people around the world turned to video games to stay occupied while under lockdown during the pandemic, cybercriminals took note and launched new campaigns with the aim of targeting gamers according to new research from Zscaler (opens in new tab).
These attacks often exploit the popularity of certain games such as Among Us (opens in new tab) to lure players into downloading fake versions which serve malware (opens in new tab). However, cybercriminals have also begun to deploy ransomware, credential stealers and cryptominers to target gamers as well.
One thing that many of these new campaigns share in common is the fact that cybercriminals have begun to leverage the group-chatting platform Discord (opens in new tab) as a CDN for hosting their malicious payloads. While using the service to host payloads is not new, there was an uptick in the number of cybercriminals doing so last year.
- We've put together a list of the best antivirus (opens in new tab) software around
- Keep your devices virus free with the best malware removal software (opens in new tab)
- Also check out our roundup of the best ransomware protection (opens in new tab)
For instance, an attacker can upload a malicious file on a Discord channel and share its public link with others who use the service as well as with those that don't. Even worse, a file sent from Discord is there forever so even if an attacker deletes a file shared via the service, its link can still be used to download the malicious file.
In a new report (opens in new tab), Zscaler's ThreatLabZ team explained how its researchers have observed multiple payloads including the Epsilon ransomware, Redline stealer, XMRig miner (opens in new tab) and Discord token grabbers (opens in new tab) shared using the service.
Many of the malicious files used in these campaigns are renamed as pirated or gaming software in an effort to trick gamers into downloading them. Cybercriminals also use file icons related to popular games to entice users into opening them.
At the same time, attackers are also using Discord for command-and-control (C&C) communication as we saw last year with a new version of the AnarchyGrabber trojan (opens in new tab). For those unfamiliar, C&C servers are remote hosts that are used to send commands to malware to be executed on an infected computer.
In their report on the matter, Zcaler's Avinash Kumar, Aditya Sharma and Abhay Kant Yadav explained how Discord's growing popularity outside of gaming and its CDN capabilities have made the service popular among cybercriminals, saying:
“Discord is primarily a chatting platform built for gamers and is becoming increasingly popular among other professional communities for sharing information. We’re observing an increase in the usage of the Discord app to deliver malicious files by attackers. Due to the static content distribution service, it is highly popular among threat actors to host malicious attachments that remain publicly accessible even after removing actual files from Discord.”
- We've also featured the best endpoint protection (opens in new tab)