Darknet Markets Offer Stolen Gaming Accounts, Credential Lists and Gamer-Targeting Scams
Summary
DarkOwl describes darknet activity targeting gamers and streaming users, including account sales, credential stuffing, malicious links, scams, malware, and recruitment. It reports nearly 100,000 documents advertising credential lists in the past year.
Key points
- DarkOwl observed gaming and streaming accounts offered for sale, including accounts allegedly sold without their owners’ knowledge.
- Account brokers use leaked credentials, credential stuffing and brute-force tools to obtain accounts for resale.
- DarkOwl found offers for combolists, often containing hundreds of thousands of credential pairs; the lists can be tested against commercial service logins.
- Malicious game cheats, gifts and third-party links may deliver malware or phish for personal and account information.
- The article describes scams, doxxing and swatting targeting gamers, as well as malware targeting gaming credentials and user tokens.
- DarkOwl reports nearly 100,000 darknet and deep-web documents advertising combolists over the past year.
Article Details
- Publisher
- DarkOwl
- Report Period
- July 2022; includes observations and incidents from 2021 and the prior year
- Scope
- Darknet and deep-web discussions and offers involving gaming and streaming accounts, credential theft, pirated games, scams, malware, and recruitment.
- Sample Size
- Nearly 100,000 darknet and deep-web documents scraped in the last year for combolist offers.
- Key Statistics
- DarkOwl reports scraping nearly 100,000 documents for combolist offers in the last year.
- Combolists are advertised as containing hundreds of thousands of credential combinations each; the article notes that even a 1% credential-stuffing success rate could yield a significant volume of accounts.
MITRE ATT&CK
T1110.001 · Password GuessingThe article describes brute-force password cracking utilities used to obtain accounts.T1110.004 · Credential StuffingAccount brokers reportedly use credential stuffing against commercial service logins to validate leaked credential combinations.T1204 · User ExecutionVictims may be tricked into opening links offering game cheats or gifts, which can install malware.T1555 · Credentials from Password StoresThe article reports malware targeting game account logins and user tokens.T1566 · PhishingPlayers are sent malicious third-party links described as phishing links that solicit personal information or account logins.T1567 · Exfiltration Over Web ServiceCyber criminals reportedly exfiltrated video game source code and resold it on the darknet.T1598 · Phishing for InformationScammers use social engineering to elicit personal information from gamers for identity theft and financial fraud.
Threat Actors
Malware
Products
AmazonDarkOwl has also observed accounts for all of the mainstream video streaming services, such as, Hulu, Amazon, Disney+, Netflix, HBO Max.Call of DutyThe desensitization of first-person shooting games like Call of Duty and Grand Theft Auto (GTA) helps radicalization of individuals, especially teenagers between the ages of 11-17 years to carry out violent acts againstCyberpunk 2077In February 2021, cyber criminals gained access to the CD Projekt and exfiltrated the source code for Cyberpunk 2077, The Witcher 3, and Gwent.Discordinformation specific to video game users like account logins and user tokens for Steam, Epic, VimeWorld, Discord, and EA.Disney+DarkOwl has also observed accounts for all of the mainstream video streaming services, such as, Hulu, Amazon, Disney+, Netflix, HBO Max.Dota 2Accounts and accessories for popular video games such as PlayerUnknown’s BattleGrounds (PUBG), Dota 2, League of Legends (LoL), and Counter Strike (CS): Global Offensive are amongst those that regularly traded.EAspecific to video game users like account logins and user tokens for Steam, Epic, VimeWorld, Discord, and EA.Epicbut target information specific to video game users like account logins and user tokens for Steam, Epic, VimeWorld, Discord, and EA.FIFA 2021In July, the LAPSUS$ criminal group successfully exfiltrated the source code from Electronic Arts Fifa 2021 soccer game and the proprietary FrostBite game engine, which was the foundation for other popular games by theFIFA 22For example, one document in Vision details the Fifa 2022 Coin Generator to acquire unlimited free FIFA 22 coins and points for one’s “Ultimate Team” and according to the offer, secure players like Gullit, Ronaldo, andFrostBitesuccessfully exfiltrated the source code from Electronic Arts Fifa 2021 soccer game and the proprietary FrostBite game engine, which was the foundation for other popular games by the video game publisher.Grand Theft AutoThe desensitization of first-person shooting games like Call of Duty and Grand Theft Auto (GTA) helps radicalization of individuals, especially teenagers between the ages of 11-17 years to carry out violent acts againstGwentIn February 2021, cyber criminals gained access to the CD Projekt and exfiltrated the source code for Cyberpunk 2077, The Witcher 3, and Gwent.HBO MaxDarkOwl has also observed accounts for all of the mainstream video streaming services, such as, Hulu, Amazon, Disney+, Netflix, HBO Max.HuluDarkOwl has also observed accounts for all of the mainstream video streaming services, such as, Hulu, Amazon, Disney+, Netflix, HBO Max.League of LegendsAccounts and accessories for popular video games such as PlayerUnknown’s BattleGrounds (PUBG), Dota 2, League of Legends (LoL), and Counter Strike (CS): Global Offensive are amongst those that regularly traded.NetflixIn early 2022, Netflix reported over 221.6 million global MAUs of their services.PUBGAccounts and accessories for popular video games such as PlayerUnknown’s BattleGrounds (PUBG), Dota 2, League of Legends (LoL), and Counter Strike (CS): Global Offensive are amongst those that regularly traded.SteamThere are over 134 million registered monthly active users (MAUs) on the popular video gaming distribution platform, Steam; an estimated 62 million connect daily to the service.The Witcher 3In February 2021, cyber criminals gained access to the CD Projekt and exfiltrated the source code for Cyberpunk 2077, The Witcher 3, and Gwent.TwitchThis is often carried out in the middle of a game or Twitch stream where the audio and video of the SWAT team arriving can be witnessed by others.VimeWorldtarget information specific to video game users like account logins and user tokens for Steam, Epic, VimeWorld, Discord, and EA.
Tools
Industries
StreamingTwo years after the COVID-19 pandemic forced the world into their homes for quarantine, video gaming and streaming subscription service use is at an all-time high.Video gamingTwo years after the COVID-19 pandemic forced the world into their homes for quarantine, video gaming and streaming subscription service use is at an all-time high.