Forest Global Training Partners

Cyber Risks · Cisco Talos

Cheating the cheater: How adversaries are using backdoored video game cheat engines and modding tools

Summary: Cisco Talos reports that video game cheat engines and modding tools downloaded from questionable sources, often promoted through YouTube advertisements and "How To" videos, are commonly backdoored with remote access trojans, with one sample installing the longstanding information stealer XtremeRAT. The sample was a VisualBasic 6 executable not initially listed on VirusTotal, and Talos detailed its obfuscated clsComplexDataConsumer class, Chr$-encoded strings, and shellcode that resolves API addresses and performs process injection.

Bottom line: Employees working remotely who mix personal gaming and modding with work on the same machine pull these backdoored tools onto enterprise networks, and the sample's weak and generic antivirus classifications mean detection tooling may not flag it before the RAT is running.

Read the original at Cisco Talos ↗

Topics
Malware
Related