Global RenEngine Loader attack campaign examined

GBHackers News reports that more than 400,000 machines around the world have been targeted with the RenEngine Loader malware that spreads the ACR Stealer as part of an attack campaign that has been underway since April.

India, the U.S., and Brazil were most targeted by the intrusions, which involved the concealment of illicit logic within the Ren'Py launchers of pirated versions of widely used games, including Assassin's Creed, FIFA, and Far Cry, according to an analysis from the Howler Cell Threat Research Team. Installing and launching the game triggers the execution of a hidden Python script that allows RenEngine Loader to conduct sandbox checks before running a more advanced HijackLoader variant.

Apart from identifying GPU virtualization and hypervisor activity, HijackLoader leverages process doppelganging before launching ACR Stealer, which facilitates the exfiltration of browser credentials and cookies, system details and clipboard contents, and cryptocurrency wallet information, said researchers, who regarded the campaign as a malware delivery breakthrough.