APT41__2019__Gaming-Industry.Asia.pdf

ESET reports multiple supply-chain compromises of game executables that embed a Winnti-family backdoor which hooks the PE entry point to decrypt and launch an in-memory DLL; the report details payload structure, RC4/RC5 encryption, C2 domains and IPs, available commands, second-stage Win64 components, IoCs (file hashes, domains, IPs), and victim distribution concentrated in Southeast Asia, noting that the attackers exclude Russian/Chinese locales.