Threat actors are currently targeting gamers by distributing trojanized gaming utilities through browsers and chat platforms to deploy a multi-purpose Java-based Remote Access Trojan (RAT).

Key Attack Details

• Infection Vector: Malicious versions of gaming tools are shared via web browsers and chat platforms like Discord or Telegram.
• Malware Mechanism: The downloader stages a portable Java runtime to execute a malicious Java archive (JAR) file, often named jd-gui.jar.
• Stealth Tactics:
  • Uses PowerShell and Living-off-the-Land Binaries (LOLBins) like cmstp.exe for silent execution.
  • Automatically configures Microsoft Defender exclusions for its own components and deletes the initial downloader to erase tracks.
• Persistence: Achieved through scheduled tasks and a Windows startup script named world.vbs.
• Capabilities: The malware functions as a loader and RAT, connecting to a C2 server (e.g., 79.110.49[.]15) to exfiltrate data or deploy additional payloads.

Contextual Threats

This campaign follows a broader trend of “gaming-adjacent” malware:

• Webrat: Disguised as cheats for games like Rust and Roblox to target users, as detailed by Kaspersky’s Securelist.
• StrRAT: A common Java-based RAT that steals credentials and mimics ransomware, often tracked by researchers on Any.Run.
• Ratty RAT: An open-source Java Trojan that leverages cross-platform compatibility, frequently documented on GitHub.