- Hackers performed around 12 billion credential stuffing attacks worldwide against gaming websites over a period of around 18 months.
- Attacks on gaming, food and beverages, and financial services are up by seven percent, six percent, and three percent.
The world is currently going through a rough patch since the pandemic outbreak of COVID-19. Today, people are spending an enormous amount time on online platforms doing a variety of activities in their free time. Cybercriminals, on the other hand, continue to exploiting people and organizations through their vulnerabilities.
What happened?
Researchers from the security firm, Imperva, highlighted changes in traffic and attack patterns across different industries and countries after coronavirus spread in a new report.
- Over the past few months, attacks on gaming, food and beverages, and financial services are up by seven percent, six percent, and three percent, respectively.
- The criminals are after personal identifiable information (PII), or card details or other banking credentials.
Recent attacks faced by the Gaming Industry
- On April 18, 2020, an anonymous hacker leaked the usernames and passwords (around 1 GB of data) of close to 23 million players of Webkinz World, a children game by Canadian firm, Ganz. Security experts alleged that the hacker used an SQL injection vulnerability present in one of the website's web forms.
- In mid-April, researchers exposed attackers deploying malicious software to lure people into providing access to the beta version of “Valorant,” a new title from Riot Games. The malware allowed attackers to record users' keystrokes, helpful in stealing username and password credentials.
- Around the same time, there was a series of large scale DDoS attacks on EA Sports that forced the company to pull its servers offline globally. Its customers including Snopp Dogg complained about EA Sports’ service disruption. The outage had also impacted customers in Canada, Egypt, South Africa, etc.
- In another April incident, an attacker managed to infiltrate the SCUF Gaming’s unsecured database, containing more than 1.1 million customer records. The hacker claimed to have copied all the data and demanded a ransom of 0.3 BTC in a note.
- At the end of the March, attackers took down more than 50 sportsbooks sites powered by SBTech. This had maximum victims covered in the US and Europe. The exact nature of the threat remained unknown.
- In the third week of February, researchers discovered a powerful malware ‘LokiBot’ that infect gamers worldwide by impersonating the launcher for Epic Games, the developer behind games like Fortnite. The fake downloader is distributed via spam phishing emails to potential targets, in bulk.
Understanding attacks in the gaming industry
- Hackers worldwide performed around 12 billion credential stuffing attacks against gaming websites within the 17-month period, from November 2017 to March 2019.
- The attackers usually look for valid accounts and unique skins in popular games to hack and sell those in the underground marketplace.
- Besides, attackers go after game accounts connected to a valid credit card or other financial resources for card skimming attempts.
- Also, hacked accounts with higher value are sold at an exorbitant price, and there are enough crazy people to pay for those.
An important takeaway from the report was that hackers are not only committing a crime by themselves, but also roping in young gamers and to work for their objectives. Surprisingly, 82% of teens and young adults recruited by experienced hackers had developed their cybercrime skills through video gaming, as mentioned in the report.
Closing thought
Learning from the trends, gamers should stay alert and not click on anything suspicious to avoid falling prey to cybercrime campaigns.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/bb7f_shutterstock_660345646.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/ac29_shutterstock_563020846.jpg)
