LofyGang Returns With LofyStealer Campaign Targeting Minecraft Players
Summary
ZenoX attributes a new campaign targeting Minecraft players to LofyGang. A fake “Slinky” hack delivers LofyStealer, which reportedly steals browser data; the group is also offering a Slinky Cracked builder through a malware-as-a-service model.
Key points
- The report attributes the campaign to LofyGang, which had previously targeted Minecraft players and used npm typosquatting to distribute stealers.
- A fake Minecraft “Slinky” hack triggers a JavaScript loader that deploys LofyStealer, also called GrabBot, and executes it in memory.
- The stealer reportedly collects cookies, passwords, tokens, payment-card data and IBANs from multiple browsers.
- The collected data is reportedly sent to a command-and-control server at 24.152.36[.]241.
- The report describes a shift toward malware-as-a-service, including free and premium tiers and a builder called Slinky Cracked.
Article Details
- Event Type
- Infostealer campaign targeting Minecraft players
- Impact
- The campaign uses a fake Minecraft hack to deliver LofyStealer (also called GrabBot). The malware harvests browser cookies, passwords, tokens, payment-card data, and IBANs, then exfiltrates the data to a reported command-and-control server. The article also reports a shift by LofyGang toward a malware-as-a-service model.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 24[.]152[.]36[.]241 | Reported command-and-control server receiving data exfiltrated by LofyStealer. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelHarvested data is exfiltrated to the reported command-and-control server.T1059.007 · JavaScriptA JavaScript loader is executed to deploy LofyStealer.T1204.002 · Malicious FileThe fake Minecraft hack relies on users launching it, which triggers the infection.T1555.003 · Credentials from Web BrowsersLofyStealer harvests passwords and other data from web browsers.
People
Threat Actors
FIN11Named as an alias of Rift Brigantine, which the article attributes with activity involving fraudulent GitHub repositories and malware delivery.GRACEFUL SPIDERNamed as an alias of Rift Brigantine, which the article attributes with activity involving fraudulent GitHub repositories and malware delivery.LofyGangThe article attributes the campaign to LofyGang with high confidence. The group is reported to use a fake Minecraft hack to deliver LofyStealer and to offer a malware-as-a-service model.Rift BrigantineThe article attributes activity involving fraudulent GitHub repositories and malware delivery to Rift Brigantine.TA505Named as an alias of Rift Brigantine, which the article attributes with activity involving fraudulent GitHub repositories and malware delivery.
Malware
Products
Avast Browserincluding Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.Braveof sensitive data spanning multiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.Chrome Betaaim to harvest a wide range of sensitive data spanning multiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.Google Chromewith an aim to harvest a wide range of sensitive data spanning multiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.Microsoft Edgea wide range of sensitive data spanning multiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.MinecraftA Brazil-origin cybercrime group known as LofyGang has resurfaced after more than three years to target Minecraft players with a new stealer called LofyStealer (aka GrabBot) disguised as a fake “Slinky” hack.Mozilla Firefoxmultiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.Operadata spanning multiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.Opera GXdata spanning multiple web browsers, including Google Chrome, Chrome Beta, Microsoft Edge, Brave, Opera, Opera GX, Mozilla Firefox, and Avast Browser.