Operation Ice Breaker Targets The Gambling Industry

Operation IceBreaker targeted the gambling and gaming industries by means of social engineering, where the attacker tried to lure employees into executing a novel backdoor. It is suspected the attacker is not an English speaker, and this campaign name was born from the "ICE" conference. The modus operandi of the threat actor is to impersonate a customer of the website and share a malicious zip or LNK file disguised as a screenshot of an issue related to account login. The support agent executes the downloaded file, and the malicious server is contacted to fetch the second stage, the backdoor, and executes it. The malware steals data from local storage and exfiltrates information to the adversary via web sockets.