The thing is that these hackers typically target large organizations like banks, IT companies, universities, and even government agencies. But this time, Lazarus hit an individual user, planting a backdoor on a personal computer! The cybercriminals lured the victim to a game site and thereby gained complete access to their system. Three things made this possible:<\/p>\n
- \n
- The victim\u2019s irresistible desire to play their favorite tank game in a new format<\/li>\n
- A zero-day vulnerability in Google Chrome<\/li>\n
- An exploit that allowed remote code execution in the Google Chrome process<\/li>\n<\/ul>\n
Before you start to worry, relax: Google has since released a browser update, blocked the tank game\u2019s website, and thanked<\/a> the Kaspersky security researchers. But just in case, our products<\/a>\u00a0detect both the Manuscrypt backdoor and the exploit. We\u2019ve delved into the details of this story on the Securelist blog<\/a>.<\/p>\n
Fake accounts<\/h2>\n
At the start of the investigation, we thought the group had gone to extraordinary lengths this time: \u201cDid they actually create an entire game just for a scam?\u201d But we soon worked out what they\u2019d really done. The cybercriminals based their game \u2014 DeTankZone \u2014 on the existing game DeFiTankLand. They really went all out, stealing the source code of DeFiTankLand and creating fake social media accounts for their counterfeit.<\/p>\n
Around the same time, in March 2024, the price of the DefitankLand (sic) cryptocurrency plummeted \u2014 the developers of the original game announced<\/a> that their cold wallet<\/a> had been hacked, and \u201csomeone\u201d had stolen $20,000. The identity of this \u201csomeone\u201d remains a mystery. The developers believe it was an insider, but we suspect that the ever-present tentacles of Lazarus are involved.<\/p>\n
![\"Differences](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2024\/11\/08185316\/how-to-play-tanks-and-catch-backdoor-1.png\")
<\/a>Differences between the fake and the original are minimal<\/p><\/div>\n
The cybercriminals orchestrated a full-blown promotion campaign for their game: they boosted follower counts on X (formerly Twitter), sent collaboration offers to hundreds of cryptocurrency influencers (also potential victims), created premium LinkedIn accounts, and organized waves of phishing emails. As a result, the fake game got even more traction than the original<\/a> (6000 followers on X, versus 5000 for the original game\u2019s account).<\/p>\n
![\"Social](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2024\/11\/08185336\/how-to-play-tanks-and-catch-backdoor-2.png\")
<\/a>Social media content created by AI with the help of graphic designers<\/p><\/div>\n
How we played tanks<\/h2>\n
Now for the most fun part\u2026<\/p>\n
The malicious site that Lazarus lured their victims to offered a chance, not only to \u201ctry out\u201d a zero-day browser exploit, but also to play a beta version of the game. Now, here at Kaspersky, we respect the classics, so we couldn\u2019t resist having a go on this promising new version. We downloaded an archive that seemed completely legitimate: 400MB in size, correct file structure, logos, UI elements, and 3D model textures. Boot her up!<\/p>\n
The DeTankZone start menu greeted us with a prompt to enter an email address and password. We first tried logging in using common passwords<\/a> like \u201c12345\u201d and \u201cpassword\u201d but that doesn\u2019t work. \u201cFine, then\u201d, we think. \u201cWe\u2019ll just register a new account\u201d. Again, no luck \u2014 the system wouldn\u2019t let us play.<\/p>\n
![\"The](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2024\/11\/08185420\/how-to-play-tanks-and-catch-backdoor-3.png\")
<\/a>The start menu inspires confidence with a seemingly legitimate login form<\/p><\/div>\n
So why were there 3D model textures and other files in the game archive? Could they really have been other components of the malware? Actually, it wasn\u2019t that bad. We reverse-engineered the code and discovered elements responsible for the connection to the game server \u2014 which, for this fake version, was non-functional. So, in theory, the game was still playable. A bit of time spent, a little programming, and voil\u00e0<\/em> \u2014 we replace the hackers\u2019 server with our own, and the red tank \u201cBoris\u201d enters the arena.<\/p>\n
![\"The](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2024\/11\/08185452\/how-to-play-tanks-and-catch-backdoor-4.png\")
<\/a>The game reminded us of shareware games from 20 years ago \u2014 which made all the effort worthwhile<\/p><\/div>\n
Lessons from this attack<\/h2>\n
The key takeaway here is that even seemingly harmless web links can end up with your entire computer being hijacked. Cybercriminals are constantly refining their tactics and methods. Lazarus is already using generative AI with some success, meaning we can expect even more sophisticated attacks involving it in the future.<\/p>\n
Security solutions<\/a> are also evolving with effective integration of AI \u2014 learn more here<\/a> and here<\/a>. All ordinary internet users have to do is make sure their devices are protected<\/a>,<\/strong> and stay informed about the latest scams. Fortunately, the Kaspersky Daily blog makes this easy \u2014 subscribe<\/a> to stay updated\u2026<\/p>\n\n","protected":false},"excerpt":{"rendered":"
Cybercriminals have devised a new ruse: luring gamers to a modish crypto tank-game to gain full access to their computers.<\/p>\n","protected":false},"author":2706,"featured_media":23529,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1225,1486],"tags":[1505,163,76,695,2791],"class_list":{"0":"post-23526","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-privacy","8":"category-threats","9":"tag-cryptocurrencies","10":"tag-gaming","11":"tag-phishing","12":"tag-scam","13":"tag-zero-day-vulnerability"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/how-to-play-tanks-and-catch-backdoor\/23526\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/how-to-play-tanks-and-catch-backdoor\/28271\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/how-to-play-tanks-and-catch-backdoor\/28412\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/how-to-play-tanks-and-catch-backdoor\/27787\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/how-to-play-tanks-and-catch-backdoor\/30528\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/how-to-play-tanks-and-catch-backdoor\/29279\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/how-to-play-tanks-and-catch-backdoor\/38498\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/how-to-play-tanks-and-catch-backdoor\/12940\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/how-to-play-tanks-and-catch-backdoor\/52561\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/how-to-play-tanks-and-catch-backdoor\/22352\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/how-to-play-tanks-and-catch-backdoor\/23095\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/how-to-play-tanks-and-catch-backdoor\/28482\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/how-to-play-tanks-and-catch-backdoor\/34367\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/how-to-play-tanks-and-catch-backdoor\/33992\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/scam\/","name":"scam"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/23526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2706"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=23526"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/23526\/revisions"}],"predecessor-version":[{"id":23530,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/23526\/revisions\/23530"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/23529"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=23526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=23526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=23526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}