More than 2 billion breached Fortnite accounts are up for sale in underground forums so far in 2020 alone!
Hackers are believed to be making over a $1 million per annum selling compromised accounts for the popular Fortnite video game in underground forums.
350 million
With Fortnite’s huge popularity rocketing recently, it now has more than 350m worldwide players – the game is a lucrative vehicle for cyber-criminals.
So lucrative, in fact, that 2 billion breached accounts are up for sale in ‘underground’ forums so far in 2020 alone, observes a new report.
$1.2 million annually
From adding-up auction sales for a number of high-end & low-end Fortnite account sellers over 3 months, researchers discovered that high end, sellers averaged $25,000 pw in account sales — about $1.2 million annually.
“The market for stolen account sales is much larger than just the gaming industry. However, from our research, the black market for the buying & selling of stolen Fortnite accounts is among the most expansive, & also the most lucrative,” commented researchers with Night Lion Security in a report.
‘Skin’
The real value of a hacked Fortnite account is keyed to a character’s in-game “skin” (basically a digital costume), researchers explained.
Players can buy these in-game accessories using Fortnite’s currency, called ‘V-Bucks’. Some of the skins are rare & valuable e.g., the “Recon Expert” skin is one of the most valuable, averaging roughly $2,500 per account.
DonJuji
Fortnite accounts are first hacked via simple ‘brute force’ & password cracking: Username & password combinations can be taken through data breaches of other companies, & checked against Fortnite accounts, as many people reuse passwords.
Cyber-criminals have tools that can make these types of tricks even easier.
One well-known password cracker in underground hacking circles (known as “DonJuji”) says high-end Fortnite cracking tools can average between 15 & 25,000 checks every minute (roughly 500 account checks per second), outlines the report.
Accounts up for sale
Epic Games does limit the number of logins allowed per IPs in an attempt to reduce password cracking attempts. However, cybercriminals bypass this by using automatic proxy rotation, which creates a new IP for each request.
A popular Fortnite account checker called Axenta (costing $15 a month), e.g., provides automatic proxy rotation, as well as some other different built-in tools letting password checking & automatic password changing.
Cyber-criminals then create “logs” of these compromised accounts & sell them. These collections, which contain 1,000 stolen accounts, are auctioned in private Telegram channels for anything between $10,000-$50,000. Accounts are then extracted from the log & individually put-up for sale.
Underground Marketplace
Night Lion Security described a sophisticated underground marketplace, with “distributors” 1st selling these logs to “resellers,” who then sell them on to “consumers.”
Some account resellers host their own account shops on sites (like shoppy.gg or atshop.io), which have a mixture of accounts that can be bought, including Netflix, Disney+, HBO Max etc.
Digital accessories & skins are highly sought after.
These marketplaces are highly organised, & even have customer service & return policies. One site is governed by a system called “Community Checkup.” Community Checkup, is made up of a group of 5 “judges,” & keeps track of scammers, sellers & buyers who are breaking ‘community rules.’
Video Games
Observes the report, video games in general are highly profitable for cyber-criminals, with Roblox, Runescape, & Minecraft also popular on underground forums.
“We can then confidently predict that an additional 30% revenue, or $300 million pa, can be generated by tallying the black-market sales for every other video game in existence, conservatively making the entire hacked video game market a billion-dollar a year industry,” commented researchers.
Android Apps
Fortnite has previously been challenged by a number of security problems. In 2018, malicious Android apps purporting to be Fortnite were found to be accessing cameras, taking & wiping device data, & recording audio on victims’ phones.
In 2019, Epic Games patched a bug that could let hackers to break into millions of Fortnite accounts & steal virtual currency, or resell virtual goods. Also, in 2018, a ransomware called “Syrk” targeted Fortnite’s vast user base, pretending to be a game hack tool.
https://www.cybernewsgroup.co.uk/virtual-conference-september/
