Affected by the data leak mostly are companies from the financial industry, but we should be aware that other industries are also targeted. Behold the gaming industry is now the internet‘s talk, where it is reported by a threat advisory post that there are 500,000 leaked credentials are for sale online. The alarming thing is the victim of the data breach hacks are one of the top two dozen leading gaming companies, Ubisoft.
Ubisoft became a prominent target, 500,000 insider leaks for sale!
To anyone who plays games from Ubisoft, you may have to raise your alarm and do some security health check on your credentials. It has been circulating online that Database brokers sell leaked insider-credentials. Over 500,000 stolen credentials are linked to the 25 most prestigious gaming companies found on caches of breached data online and up for sale at dark web and criminal marketplaces, based on reports submitted by Kela.
Kela‘s insight is quite unique as it exposes how hackers made it in this enormous $196 billion industry. According to them, there is a growing success in this industry, so it attracted hackers. On top of the booming and rising popularity of the gaming industry, most booming sectors may not be paying attention to their security measures as much as their industry advancement and profit. We had seen different industries who were booming that neglected their cybersecurity. The best example would be tech giants that exist before they became more gigantic. They have been the topic of a data breach in the past, such as Facebook. Kela also mentioned that one of the tools used to hack gaming firms includes the malware AZORult, an info-stealing malware used to get victims’ credentials. We can say that the malware method is a type of spear-phishing attack through malware because the researchers said that the siphoned credentials are further used to compromise a target‘s network. They added that ransomware will always be part of their modus to extort these big companies.
The researchers continue to consider that employees are still one of the primary weak points in attacks. These include company partnership with third parties where some of them are why credentials were leaked in the first place. It is not like that this information was leaked in purpose. Still, through different techniques and social engineering tactics, the employees without proper training against these attacks are vulnerable as an entry point.
Conclusion on the Gaming Industry security
One of you right now may be registered as a customer of some gaming companies. You should be alarmed because the hacks include bots implanted to admin and premium game developer machines which means access to such are available once that bot infecting the computer falls into an adversary’s hands. Bots can easily be purchased for a few dollars. We advise that employees exercise more vigilance when browsing and dealing with people over the internet. Use more stringent password guidelines such as frequent or scheduled password changes and creative multi-factor authentication policies.
The outlook on the gaming industry this 2021 is positive, threat actors are becoming more sophisticated and creative. Expect that there will be more attacks on the industry. Some of which may succeed and sell off to the dark web. How do you mitigate credentials for sale on the dark web? Employ a threat intelligence team specialising in dark web monitoring to look for these data, then analyse it, and then do the necessary mitigations based on company protocols.
