Using this access, hackers tampered with the download URL of NoxPlayer updates in the API server to deliver malware to NoxPlayer users. Despite evidence implying that attackers had access to BigNox servers since at least September 2020, ESET said the threat actor didn’t target all of the company’s users but instead focused on specific machines, suggesting this was a highly-targeted attack looking to infect only a certain class of users. Until today, and based on its own telemetry, ESET said it spotted malware-laced NoxPlayer updates being delivered to only five victims, located in Taiwan, Hong Kong, and Sri Lanka.
“We discard the possibility that this operation is the product of some financially motivated group,” an ESET spokesperson told ZDNet today via email. “We are still investigating, but we have found tangible correlations to a group we internally call Stellera, which we will be reporting about in the near future.”