December 4, 2019 By David Bisson 2 min read

A new malware campaign is using Cobalt Strike and a trojanized Tetris app to target multiple industries with the PyXie RAT.

BlackBerry Cylance noted that PyXie hasn’t generated much attention from the security community since it was first observed in 2018, but this campaign stood out for its abuse of Cobalt Strike, a penetration testing toolkit, along with a custom shellcode loader that’s appeared in several ransomware incidents. The loader is a trojanized, open-source Tetris game that loads an encrypted shellcode payload named settings.dat from an internal network. Upon decryption, the payload revealed itself to be a Cobalt Strike stager that connected back to one of four servers.

Further analysis revealed that the campaign began by using legitimate applications to load the first-stage components of the malware. These binaries located their corresponding encrypted payloads, which were responsible for establishing persistence. They also installed the Cobalt Mode downloader. Ultimately, this asset loaded PyXie, a remote-access Trojan (RAT) that’s capable of stealing cookies, keylogging and other malicious activity.

A Broad Array of Digital Threats Facing Gamers

The PyXie campaign described above isn’t the first time that attackers have used malicious gaming apps. Back in 2015, Trend Micro detected RetroTetris, a malicious Tetris app that managed to infiltrate the Google Play store. The digital threats facing gamers aren’t limited to Tetris lookalikes, of course.

In June 2019, Kaspersky Lab revealed that 900,000 users had fallen victim to malware infections from fake video games over the span of a year. Some of those threats are known to directly prey upon gamers. Illustrating this fact, ESET found that Teslacrypt ransomware has made a habit of encrypting game data for some of the most well-known games, such as Call of Duty and Minecraft.

How to Defend Against the PyXie RAT

Security professionals can help their organizations defend against threats like the PyXie RAT by using vulnerability watchlist features to be on the lookout for zero-day threats. This method will help prevent malware authors from leveraging undisclosed security weaknesses to infiltrate enterprise systems. Additionally, companies should consider investing in artificial intelligence (AI)-powered solutions and deploying these strategically so they can help monitor for increasingly sophisticated threats like PyXie.

More from

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Hacking the mind: Why psychology matters to cybersecurity

4 min read - In cybersecurity, too often, the emphasis is placed on advanced technology meant to shield digital infrastructure from external threats. Yet, an equally crucial — and underestimated — factor lies at the heart of all digital interactions: the human mind. Behind every breach is a calculated manipulation, and behind every defense, a strategic response. The psychology of cyber crime, the resilience of security professionals and the behaviors of everyday users combine to form the human element of cybersecurity. Arguably, it's the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today