THREAT OPS › Threat News › 41 deceptive download sites show a real link, then send you somewhere else
41 deceptive download sites show a real link, then send you somewhere else
<p class="wp-block-paragraph">We identified a network of 41 websites impersonating popular games and Windows software, all designed to push visitors towards the same Download Studio installer. </p>
<p class="wp-block-paragraph">The sites advertise everything from Counter-Strike, Half-Life, Fallout, Roblox, PUBG, and The Witcher to VLC, 7-Zip, Paint.NET, VMware, Total Commander, and Foxit PDF.</
MITRE ATT&CK techniques
Indicators of compromise
- 9a3f6e69c12cb814c45862219ecb17e9ab7744877c9da1c49f3ea046437f8fcasha256
- https://www.gendigital.com/blog/insights/research/fakembam-backdoor-delivered-through-software-updatesurl
- r.byteengineering.netdomain
- apis.downloadstud.iodomain
- downloadstudio.netdomain
- getdownloadstudio.netdomain
- 4kvideodownloader.rudomain
- acronisportal.rudomain
- cristalixmine.rudomain
- crystaldisk24.rudomain
- csgodownload.rudomain
- cupheadplay.rudomain
- fallout24.rudomain
- farcryplay.rudomain
- faststoneportal.rudomain
- formatf.rudomain
- foxitpdf.rudomain
- get7zip.rudomain
- getaf.rudomain
- getaimp.rudomain
- getavast.rudomain
- getbandicam.rudomain
- getbluestacks.rudomain
- getmovavi.rudomain
- getrecuva.rudomain
- getultraiso.rudomain
- getvmware.rudomain
- getvuescan.rudomain
- gogetter24.rudomain
- gta6-play.rudomain
- halflife-play.rudomain
- memuemulator.rudomain
- paintdotnet.rudomain
- pdfxchange.rudomain
- poppyplaytimeplay.rudomain
- pubgplay.rudomain
- rdrplay.rudomain
- regorganize.rudomain
- roblox-play.rudomain
- rust-play.rudomain