Games are over - Securelist

The report analyzes Winnti 3.0 components (a RAT DLL and a signed rootkit driver) whose encrypted configuration contains a tag referencing a major European pharmaceutical company, showing Winnti’s targeting has expanded beyond gaming; it provides filenames, service name ('Adobe Service'), and three sample hashes (Backdoor.Win64.Winnti.gy/gf and Rootkit.Win64.Winnti.ai) as indicators of compromise.