GAME ENGINES: AN UNDETECTED PLAYGROUND FOR MALWARE LOADERS

Summary from the TLDR InfoSec newsletter

Check Point researchers have detected a new malware campaign that has infected over 17K machines since late June. The new campaign uses the Godot cross-platform gaming engine to execute GDScript code, which can trigger the GodLoader malware loader. The current variant of this malware employs several sandbox-evasion techniques such as checking for the presence of 3D acceleration and checking for the amount of free space available. After infection, the script adds the full C:\\ disk to the Microsoft Defender exclusion list and then downloads further malware from Bitbucket. The current variant targets Windows systems but Check Point researchers have provided PoCs for Linux and macOS.