Kaspersky Warns Of BloodyStealer Trojan That Swipes Data From Gamers’ Accounts

Kaspersky has put out a warning for a trojan tool known as BloodyStealer. The malware was given its name by its creators as it does exactly what its namesake suggests but more importantly, the antivirus software has said that the tool has mostly been used against gamers and several gaming platforms.

As per its official blog post, BloodyStealer was discovered to have mainly affected PCs belonging to gamers and were lodged within the major gaming platforms, including Steam, Epic Games, Origin, GOG, and Bethesda. The antivirus company says that while the malware is still relatively new, it has already found victims within Europe, Latin America, and the Asia Pacific region. Worst still, the trojan is allegedly being sold on the underground market to threat actors as part of a malware-as-a-service (MaaS) distribution model, at a price of US$40 (~RM167) for a “lifetime license”.

As for what it steals, the “official” advertisement for BloodyStealer states that it steals, passwords, cookies, bank card details, gaming account details, device data, screenshots, and even logs, the last item being of particularly popular demand. Games as well are not safe from the malware, with many games stolen with the trojan can be seen being sold on the dark web, and at less than US$1 (~RM4.18) in most situations.

To avoid becoming a victim of BloodyStealer, Kaspersky is preaching that people deploy what it calls “common sense” measures: strong passwords, 2-factor authentication (2FA), downloading apps from trusted sources, and simply not clicking on links provided by strangers in emails, or even those sordid links that are usually passed on by unknown numbers via messaging apps. For gamers, it also has a guide on how to maximise the security settings for all gaming platforms.

Kaspersky Says 2020 Most Productive Year For Ransomware 2.0 In Asia Pacific

It’s no surprise that you’ve been hearing about a lot more ransomware attacks lately. Cybersecurity firm Kaspersky confirmed a significant increase in Ransomware 2.0 attacks in the Asia-Pacific (APAC) region last year.

Ransomware 2.0 refers to the hacker shift from locking data to stealing data and holding it for ransom. “2020 was the most productive year for ransomware families who moved from hostaging data to exfiltrating data, coupled with blackmailing,” said Kaspersky Lead Malware Analyst Alexey Shulmin.

He added, “In APAC, we noticed an interesting re-emergence of two highly-active groups, REvil and JSWorm. Both resurfaced as the pandemic raged in the region last year and we see no signs of them stopping anytime soon.”

REvil, in particular, has achieved quite a bit of infamy in the last few months. The hacker group reportedly claimed they breached Acer and demanded from the company the largest known ransom ever of US$50 million (~RM205.6 million). Separately, it was reported that REvil ransomware can apparently change Windows passwords and then automate a system’s file encryption via Safe Mode.

Kaspersky noted that, back in 2019, REvil hackers mostly targeted victims in the Asia Pacific – particularly in Taiwan, Hong Kong, and South Korea. Last year, however, the cybersecurity firm detected the group’s presence in almost all countries and territories.

According to Kaspersky, the biggest chunk of REvil’s industrial targets falls under the Engineering and Manufacturing category (30%) followed by Finance (14%) and Professional and Consumer Services (9%).

Kaspersky Lab Survey: Over Half Of Cybersecurity Professionals Not Allowed To Share Findings

A survey by Kaspersky Lab found that over half (52%) of IT and cybersecurity professionals are barred by company rules from sharing their findings with outsiders. This may have major cybersecurity implications and in many ways, preventing hacks, discovering vulnerabilities, and securing systems are all harder to do if professionals aren’t exchanging knowledge.

Worryingly, the survey also pointed out that only 44% of respondents have actually made their discoveries public. In companies where external sharing is allowed, 77% of cybersecurity analysts did so. But when it isn’t allowed, only 8% did – presumably in a clandestine manner and at the risk of being terminated.

Kaspersky experts noted that company-mandated secrecy is driven by worries that cybercriminals may react and adapt if they know they’ve been detected. Sergey Soldatov, head of Kaspersky Lab’s Security Operations Center, emphasised the need for balance.

“Any information about a threat will help your peers to investigate an attack and plan an effective response,” he said, but added, “until you know whether a response’s actions will be successful or not, you can’t reveal that a company is doing something, since attackers will easily understand that they were detected and go underground.”

The results from the survey which is titled IT Security Economics 2020 were based on correspondence with over 5,200 IT professionals across 31 countries in June 2020. The final report is rather long but if you want to have a go with it yourself, check out Kaspersky Lab’s blog right here.