A large-scale cyberattack campaign, dubbed StaryDobry, was launched on December 31, leveraging the season’s increased torrent activity to distribute the XMRig cryptominer using trojanised versions of popular games to propagate the malware. The attack persisted for a month and infected users worldwide, including in Russia, Brazil, Germany, Belarus, and Kazakhstan.
The cybercriminals behind the campaign used sophisticated techniques to evade detection. The malware was embedded in repackaged versions of games such as BeamNG.drive, Garry’s Mod, Dyson Sphere Program, Universe Sandbox, and Plutocracy, all distributed via torrent sites.
These malicious game installers were uploaded as early as September 2024, indicating a well-planned operation.
Once executed, the trojanised installer initiated a multi-stage infection chain to avoid antivirus detection. It first extracted and decrypted files using AES encryption, leveraging various anti-debugging methods to evade analysis.
Researchers also discovered that the malware gathered system information, including machine ID, user details, and hardware specifications, which was then encoded and sent to the attackers’ command-and-control (C2) servers.
The infection process involved multiple layers. Firstly, the dropper was used to decrypt and extract malicious files while ensuring the malware wasn’t being executed in a controlled environment. The decrypted payload disguised itself by mimicking legitimate Windows DLL files, complicating detection by security tools. After this, the malware connected to C2 servers for additional payload downloads. It is here that the XMRig Miner was used.
Furthermore, the attacks obfuscated the malware’s presence by modifying system registry entries, altering timestamps, and mimicking legitimate Windows processes. For persistence, the malware uses scheduled tasks disguised as legitimate system processes, ensuring its execution even after a reboot.
At the final stage, the altered version of XMRig Miner is installed. The miner is designed to run covertly in the background and is configured to dynamically adjust to CPU usage based on system configurations. The miner was not connected to a public pool but instead to a privately controlled mining infrastructure.
“There are no clear links between this campaign and any previously known crimeware actors, making attribution difficult. However, the use of Russian language in the PDB suggests the campaign may have been developed by a Russian-speaking actor,” researchers said.
In the News: Over 100 AWS keys found on public GitHub repositories
