FortiGuard Labs’ Post

"The old rule was to create safe, ordinary products and combine them with mass marketing. The new rule: create truly innovative products and build the marketing right into them. " CP+B's Bogusky from Baked-In This is an example of "baking in" a feature that wasn't necessary (you could just ban them), but instead chose to make it a spectacle add a little mischief into the experience that 1) Publicly shames the cheater to all the other players in a harmlessly hilarious manner. 2) Creates a sharable/talk worthy memory for players that can go viral. 3) Creates a "distinction" around something that's usually a banal feature. Well done Valve corporation #gaming #marketing

Gray Zone Warfare Network Error Occurred Fix You finally get through the long queue in this exciting new game, the map starts loading…and then boom. “Network Error Occurred” and you’re kicked back to the main menu. Let’s discuss why this frustrating error is happening and what, if anything, you can do about it. https://lnkd.in/ecTn_UHk

💡👀: Hackers discover how to reprogram NES Tetris from within the game (https://lnkd.in/dWDPgGBU)

The article shows how critical it is for developers to secure API endpoints and documentation across environments. Exposing development APIs publicly risks massive account takeovers and compromised user data. In gaming, safeguarding players' data is essential to building trust—security isn't just about user education but rigorous development practices.

One to add to your list: Hackers discover how to reprogram NES Tetris from within the game (https://lnkd.in/g86JeREq)

Coming in at number 8 is "From Akamai to F5 to NTLM... with love." by d3d! Abusing Akamai with request smuggling, to abuse F5 with cache poisoning, to abuse traffic routes, to steal NTLM credentials. This is what 3 months of research looks like! Get the low down here: ctbb.show/61

Forest Blizzard (Strontium) is at it again. This time with a tool called GooseEgg. "While a simple launcher application, GooseEgg is capable of spawning other applications specified at the command line with elevated permissions, allowing threat actors to support any follow-on objectives such as remote code execution, installing a backdoor, and moving laterally through compromised networks." More info incl. mitigation and hunting can be found in the link. #msftadvocate

Gamers beware, a new foe has appeared! 👾 In their recent article, the Sysdig Threat Research investigates the 𝗥𝗲𝗯𝗶𝗿𝘁𝗵 𝗕𝗼𝘁𝗻𝗲𝘁 — a DDoS-as-a-Service botnet that individuals can purchase to attack game servers and disrupt Twitch streamers for financial gain. 🎮 Dive into Sysdig TRT's in-depth analysis uncovering RebirthLtd's intricate operations and key players behind the scenes. 👇

Hey guys any Valorant gamers here! https://lnkd.in/e5trzdA6 I came across a cheater on the opponents team followed by a red screen while I was top fragging. I got curious how these cheats work. This video here is pretty cool. You can understand how adversaries work against the anti-cheat kernel drivers, which monitor every single system-call made by any user program. So, they write kernel level cheat drivers, use some third party mappers to bypass the requirement for a driver to run, i.e to get digitally signed by OS manufacturer. Some interesting things about Operating Systems are also told. let's not encourage invasive softwares. #OperatingSystems #Valorant

Forest Blizzard 🇷🇺 has been targeting our customers for a long time using a variety of TTPs. The team put together some new analysis on their GooseEgg tool that exploited a 2022 Print Spooler vuln. Get this patched so we can get this out of the actor’s toolbox! Forest Blizzard (STRONTIUM) is using a custom tool to obtain elevated permissions and steal credentials in compromised networks. Since at least June 2020 and possibly as early as April 2019, Forest Blizzard has used the tool, which we refer to as GooseEgg, to exploit CVE-2022-38028 in the Windows Print Spooler service as part of its post-compromise activities. Microsoft has observed Forest Blizzard using GooseEgg as part of post-compromise activities against targets including Ukrainian, Western European, and North American government, non-governmental, education, and transportation sector organizations. While a simple launcher application, GooseEgg is capable of spawning other applications specified at the command line with elevated permissions, allowing threat actors to support any follow-on objectives such as remote code execution, installing a backdoor, and moving laterally through compromised networks.