Cyber Criminals Use IceBreaker Malware To Target Gamblers
Ice Breaker is a piece of malware written using Node.js that works like a backdoor. It was first detected in 2022 by Security Joes in campaigns targeting the gaming and gambling sectors, which were easily recognizable due to the social engineering tactics used by the cybercriminals.
The identity of the individuals behind Ice Breaker attacks is currently unknown and not tied to any particular hacker group or region. However, there is evidence suggesting that they are not native English speakers.
The Ice Breaker campaigns start by the criminals reaching out to human-operated support channels for gaming/gambling platforms, showing a preference for support representatives who are not fluent in English. The attackers make false claims of failed login attempts or new account registrations, sending supposed "screenshots" through download links.
These malicious files are often hosted on fake file-hosting sites that mimic legitimate ones, but the criminals have also used Dropbox. The goal is to trick support into opening the file, usually an LNK file, which initiates a credential-seeking process and leads to a full Ice Breaker infection. If the LNK file fails, the attackers resort to a VBS file, which infects devices with the DUNIHI malware.
Ice Breaker employs various anti-analysis measures to evade detection and make reverse engineering difficult. Once successfully infiltrated, it can steal files, extract Internet cookies and login credentials from Chrome, and take screenshots.
Future versions of Ice Breaker may have additional or different capabilities as the malware gets updated and further developed.
What are advanced persistent threat actors or APTs?
Advanced Persistent Threats (APTs) are a type of cyber attack that is conducted by highly skilled and well-resourced attackers with a specific goal in mind. These attacks are typically carried out over an extended period of time, often months or even years, and are designed to remain undetected while the attacker continues to gain access to sensitive information.
APTs can be nation-state actors, criminal organizations, or other highly motivated groups, and they target specific organizations or individuals, such as high-level executives, political organizations, or critical infrastructure providers. APTs are designed to evade detection by traditional security measures and often use a combination of social engineering, zero-day exploits, and sophisticated malware to compromise the target's systems and steal sensitive data.
