Picture: BigNox, ZDNet

A mysterious hacking team has compromised the server infrastructure of a popular Android emulator and has delivered malware to a handful of victims across Asia in a really-specific offer chain attack.

The attack was identified by Slovak protection business ESET on January 25, previous week, and targeted BigNox, a company that makes NoxPlayer, a application client for emulating Android apps on Home windows or macOS desktops.

ESET claims that centered on proof its scientists collected, a threat actor compromised one particular of the company’s formal API (api.bignox.com) and file-internet hosting servers (res06.bignox.com).

Utilizing this entry, hackers tampered with the down load URL of NoxPlayer updates in the API server in purchase to provide malware to NoxPlayer end users.

“A few unique malware family members had been noticed becoming distributed from tailor-made destructive updates toselected victims, with no indicator of leveraging any financial acquire, but rather surveillance-connected abilities,” ESET said in a report shared now with ZDNet.

Despite evidence implying that attackers had obtain to BigNox servers given that at least September 2020, ESET said the danger actor failed to focus on all of the firm’s customers but rather centered on unique devices, suggesting this was a extremely-specific assault searching to infect only a specified course of buyers.

Right up until now, and centered on its very own telemetry, ESET stated it noticed malware-laced NoxPlayer updates becoming sent to only five victims, located in Taiwan, Hong Kong, and Sri Lanka.

noxplayer-victims.png

Impression: ESET

ESET has introduced right now a report with specialized details for NoxPlayers to decide if they been given a malware-laced update and how to get rid of the malware.

A BigNox spokesperson did not return a request for comment.

This incident is also the 3rd provide chain attack uncovered by ESET more than the previous two months. The initial is the case of Equipped Desktop, software utilized by lots of Mongolian govt companies. The 2nd is the circumstance of the VGCA, the official certificate authority of the Vietnamese govt.

ESET researchers did not formally url this incident to a very well-recognized hacking team. It is unclear if the NoxPlayer compromise is the operate of a condition-sponsored group or a economically-determined team searching to compromise recreation builders.

ESET did, even so, issue out that the 3 malware strains deployed by way of destructive NoxPlayer updates experienced “similarities” with other malware strains used in a Myanmar presidential business site supply-chain compromise in 2018 and in early 2020 in an intrusion into a Hong Kong university.