Kaspersky Lab

Kaspersky Lab's Winnti report documents a sustained, sophisticated APT campaign targeting online game developers and publishers: operators used signed 64-bit rootkit drivers, proxy DLLs and plugin-based RATs to steal source code, digital certificates and in-game assets, while hiding C2 via public web resources and dynamic subdomains; the publication includes full technical analysis, a real-world incident (CompanyXYZ), hundreds of IoCs (domains, IPs, MD5s) and investigator findings linking actors to Chinese-speaking underground communities.