Cracked Garry’s Mod, BeamNG.drive games infect gamers with miners

The report details the StaryDobry campaign (Dec 2024–Jan 27, 2025) in which attackers uploaded trojanized installers for popular cracked games to torrent sites; the multi-stage infection chain unpacks a dropper (unrar.dll), performs anti-analysis checks, registers persistence via regsvr32, installs a loader (MTX64.exe) and, on suitable gaming systems, deploys a modified XMRig cryptominer that connects to private mining servers; Kaspersky observed infections across Germany, Russia, Brazil, Belarus, and Kazakhstan and could not definitively attribute the actor beyond a likely Russian-speaking origin.