Cyber Security
Kaspersky Reports Growth in Gamer Cyberattacks in 2023

The global gaming community, which currently accounts for nearly half of the world’s population, has found itself increasingly under fire by cybercriminals, according to a comprehensive investigation by Kaspersky. In the period spanning from July 2022 to July 2023, the cybersecurity company discovered the growing vulnerability of the gaming user base. Cybercriminals exploited this vast community to access personal data, launching a range of attacks, including web vulnerabilities, Distributed Denial of Service (DDoS) attacks, cryptocurrency mining, and complex Trojan or phishing campaigns.
In the period from July 1, 2022, to July 1, 2023, Kaspersky’s solutions detected a substantial 4,076,530 attempts to download 30,684 unique files masked as popular games, mods, cheats, and other game-related software. These incidents affected 192,456 users worldwide. These files – primarily classified as unwanted software and often labelled as not-a-virus:Downloader (89.7%), – are not innately perilous, but they are capable of downloading various other programs, even malicious ones, onto the user’s device. Adware (5.3%) and Trojans (2.4%) were also noteworthy threats to desktop gamers.
Minecraft emerged as the favoured target among cybercriminals, responsible for triggering 70.3% of all alerts. The threats using Minecraft as bait impacted 130,619 players across the globe during the reporting period. Roblox was the second most targeted game title, contributing to 20.4% of all alerts affecting 30,367 users. Counter-Strike: Global Offensive (4.8%), PUBG (2.9%), Hogwarts Legacy (0.6%), DOTA 2 (0.5%), and League of Legends (0.3%) were also among the prominent games subjected to cyber threats.
The mobile gaming community, which, according to the Newzoo 2023 report consists of over three billion gamers or nearly 40% of the world’s population, is characterized by its significant growth and accessibility and has become an enticing target for cybercriminals. Between July 1, 2022, and July 1, 2023, Kaspersky documented 436,786 attempts to infect mobile devices, impacting 84,539 users.
Various game titles were employed as bait to target mobile gamers. Minecraft enthusiasts once again were the primary targets, as 90.4% of attacks focused on the 80,128 gamers who fell victim. Indonesian users in particular faced exploitation through Minecraft, resulting in a Trojan.AndroidOS.Pootel.a attack, discreetly registering mobile subscriptions. Iran witnessed the highest prevalence of these attacks, with 140,482 alerts impacting 54,467 Minecraft players.
PUBG: Battlegrounds Battle Royale, was the second most exploited mobile game among cybercriminals, accounting for 5.09% of all alerts, with the majority of incidents originating from Russian Federation users. Roblox (3.33%) ranked third in terms of detections but second in the number of affected users.
A noteworthy discovery involves the emergence of SpyNote, a spy Trojan distributed among Roblox users on the Android mobile platform under the guise of a mod. This Trojan exhibits various spying capabilities, including keylogging, screen recording, video streaming from phone cameras, and the ability to impersonate Google and Facebook applications to deceive users into divulging their passwords.
Phishing and counterfeit distribution pages continue to pose a significant threat to gamers. Malicious and undesired software often masquerades as popular games, disseminated through third-party websites offering pirated versions. These deceptive pages typically display inflated download counts, potentially misleading users into a false sense of security. Nonetheless, clicking the download button typically results in an archive that may contain harmful or unrelated elements, diverging from the promised content.
“In the dynamic gaming industry, which hosts a wealth of personal and financial data, cybercriminals are seizing enticing opportunities. They exploit gaming accounts by pilfering in-game assets, and virtual currency, and selling compromised gaming accounts, often with real-world value. The relentless pursuit of personal data has led to a surge in ransomware attacks, even affecting professional gamers who depend on uninterrupted play. This underscores the critical need for enhanced cybersecurity awareness within the gaming community,” comments Vasily Kolesnikov, a cybersecurity expert at Kaspersky.
To stay safe while gaming, here are some recommendations:
- It is safer to download your games from official stores like Steam, Apple App Store, Google Play or Amazon Appstore only. Games from these markets are not 100 % secure, but at least they are checked by store representatives and there is some kind of screening process: not every app can be made available in these stores.
- If you wish to buy a game that is not available through the main stores, purchase it from the official website only. Double-check the URL of the website and make sure it is authentic.
- Beware of phishing campaigns and unfamiliar gamers. Do not open links received by email or in a game chat unless you trust the sender. Do not open files you get from strangers.
- Do not download pirated software or any other illegal content, even if you are redirected to it from a legitimate website.
- A strong, reliable security solution will be a great help to you, especially if it will not slow down your computer while you are playing, but at the same time, it will protect you from all possible cyber threats.
- Use a robust security solution to protect yourself from malicious software and its activity on mobile devices.
Cyber Security
ESET Research Uncovers Iran-Aligned BladedFeline Spying on Iraqi, Kurdish Officials

The Iran-aligned threat group BladedFeline has targeted Kurdish and Iraqi government officials in a recent cyber-espionage campaign, according to ESET researchers. The group deployed a range of malicious tools discovered within the compromised systems, indicating a continued effort to maintain and expand access to high-ranking officials and government organizations in Iraq and the Kurdish region. The latest campaign highlights BladedFeline’s evolving capabilities, featuring two tunneling tools (Laret and Pinar), various supplementary tools, and, most notably, a custom backdoor Whisper and a malicious Internet Information Services (IIS) module PrimeCache, both identified and named by ESET.
Whisper logs into a compromised webmail account on a Microsoft Exchange server and uses it to communicate with the attackers via email attachments. PrimeCache also serves as a backdoor: it is a malicious IIS module. PrimeCache also bears similarities to the RDAT backdoor used by OilRig Advanced Persistent Threat (APT) group.
Based on these code similarities, as well as on further evidence presented in this blogpost, ESET assesses that BladedFeline is a very likely subgroup of OilRig, an Iran-aligned APT group going after governments and businesses in the Middle East. The initial implants in the latest campaign can be traced back to OilRig. These tools reflect the group’s strategic focus on persistence and stealth within targeted networks.
BladedFeline has consistently worked to maintain illicit access to Kurdish diplomatic officials, while simultaneously exploiting a regional telecommunications provider in Uzbekistan, and developing and maintaining access to officials in the government of Iraq.
ESET Research assesses that BladedFeline is targeting the Kurdish and Iraqi governments for cyberespionage purposes, with an eye toward maintaining strategic access to the computers of high-ranking officials in both governmental entities. The Kurdish diplomatic relationship with Western nations, coupled with the oil reserves in the Kurdistan region, makes it an enticing target for Iran-aligned threat actors to spy on and potentially manipulate. In Iraq, these threat actors are most probably trying to counter the influence of Western governments following the US invasion and occupation of the country.
In 2023, ESET Research discovered that BladedFeline targeted Kurdish diplomatic officials with the Shahmaran backdoor, and previously reported on its activities in ESET APT Activity reports. The group has been active since at least 2017, when it compromised officials within the Kurdistan Regional Government, but is not the only subgroup of OilRig that ESET Research is monitoring. ESET has been tracking Lyceum, also known as HEXANE or Storm-0133, as another OilRig subgroup. Lyceum focuses on targeting various Israeli organizations, including governmental and local governmental entities and organizations in healthcare.
ESET expects that BladedFeline will persist with implant development in order to maintain and expand access within its compromised victim set for cyberespionage.
Cloud
SentinelOne Simplifies Secure Cloud Migrations on AWS

SentinelOne today announced its participation in the Amazon Web Services (AWS) Independent Software Vendor (ISV) Workload Migration Program. This initiative supports AWS Partner Network (APN) members with SaaS offerings on AWS to accelerate and streamline workload migrations.
Through the program, SentinelOne will provide AWS customers with accelerated, secure cloud migration support, leveraging modern AI-powered CNAPP capabilities to ensure rapid and protected transitions. With access to AWS funding, technical resources, and go-to-market support, SentinelOne will help organizations reduce migration timelines and costs while maintaining robust security.
SentinelOne’s Singularity Cloud Security delivers real-time visibility and protection throughout the migration journey—whether from on-premises or another cloud—enabling a secure, seamless transition to AWS.
“Through our participation in the AWS ISV Workload Migration Program, SentinelOne is helping customers accelerate secure cloud migrations with end-to-end protection and visibility,” said Ric Smith, President of Product, Technology, and Operations at SentinelOne. “Whether moving from on-prem or another cloud to AWS, organizations can count on us to deliver the security they need throughout their journey—realizing the performance, speed, agility, and cost benefits of the cloud.”
Singularity Cloud Security combines agentless and agent-based protection for deep visibility, continuous posture management, and real-time threat detection across hybrid and multi-cloud environments. By collaborating with AWS and ecosystem partners, SentinelOne ensures seamless integration into migration projects, helping customers move faster, reduce risk, and scale confidently in the cloud.
Availability: SentinelOne’s solutions are available globally.
Cyber Security
Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats

The Middle East is facing an unprecedented surge in AI-driven bot attacks, with malicious automation now outpacing traditional defenses. Mohammad Ismail, Vice President for EMEA at Cequence Security, warns that legacy tools like IP blocklists and rate limiting are no match for today’s sophisticated threats (more…)
-
Cyber Security7 days ago
Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats
-
Cyber Security7 days ago
Honeywell Report Reveals 46% Quarterly Spike in Industrial Ransomware
-
Cyber Security1 week ago
Labubu Doll Craze: How Cybercriminals Are Exploiting the Hype
-
Cyber Security7 days ago
Sophos Boosts Firewall with New Protection and Incident Response Features
-
Cloud4 days ago
SentinelOne Simplifies Secure Cloud Migrations on AWS
-
News4 days ago
Versa and OPSWAT Partner to Strengthen SASE Security with Real-Time Device Defense
-
Cyber Security12 hours ago
ESET Research Uncovers Iran-Aligned BladedFeline Spying on Iraqi, Kurdish Officials
-
News12 hours ago
Axis Intros Next-Gen AI-Powered Dome Cameras