So we're talking about cybersecurity again today. Specifically, social engineering. As a note, I have received permission from the owner of the hacked account to write this as a cautionary article, because this was an impressively sophisticated attack.
Yesterday, I received this set of DMs from a friend—someone I know and would generally trust if they sent me a link. Reading back over this now I'm like "c'mon man this isn't even that good of an impersonation" but at the time. Well. I've been fried from work.
The second they said "Nice, im waiting" is when the alarm bells started firing. If you recall my last cybersecurity post, scams employ a sense of urgency because the longer you take to do what they want, the more time you have to figure out it's a scam.
Shortly after, a mutual friend announced this user had been hacked in a shared server that this user moderates. A few minutes later, the hacker deleted the entire shared server. So yeah, that sucked. But it is a good learning experience in how hackers operate on the modern internet, so let's break it down.
In the previous scam example, the attack was a phishing scheme asking the target to share their credit card information. This time, we've got a social engineering attack distributing malware (a variant of a "baiting" attack).
Social engineering works in four steps: Prepare, Infiltrate, Exploit, and Disengage. By hacking into an account that already has an established relationship with a target, the hacker is able to skip step 2. The hacker was likely logged in to the account for several days so they could research the user they would be impersonating (step 1) and create a plausible transmission vector for their malware (step 3). The user has game development experience, and I am a gamer, so their transmission vector ("My friend made a game; can you beta test?") was actually impressively plausible and effective.
I haven't been able to find this text anywhere else, but considering this is a fake game page it was probably written by AI. The screenshots, however, are stolen from the game Arietta of Spirits. This fooled me because I have not played the game (although my husband recognized it immediately lol). But! Once the suspicion that this was not a real game set in, I pulled one of the images into reverse image search:
Yeah bud, either this is fake, or this "friend of a friend" is going to have some legal problems.
At this point, the hacker had stopped responding to my messages (Step 4: Disengage). I wasn't able to identify their goal in this attack (I wasn't about to download their exe onto my actual computer and I don't have a forensic lab set up), but it was likely to gain access to my account(s) through token theft or install some sort of ransomware. We've reported them and Discord will deal with them now.
All that said, this absolutely would have taken time to prepare and plan, so let's go over some mitigation for this sort of situation. Like a meatspace virus, the target may be infected well before it becomes apparent to outsiders, so there's a couple extra things to check. (I didn't ask how the hacker got into the account, so this is general advice.)
First, password best practices: Passwords should be long, random, and unique. You should NEVER use the same password in more than one place. If a hacker breaks into one site, they will sell or use the passwords (whether they be stored in plaintext or encrypted) to break into other sites. You can check if your email account or passwords have been distributed in data breaches with Have I Been Pwned (This site is owned and operated by Troy Hunt, a web security consultant and regional director at Microsoft. It is the only site I trust for this purpose.)
To help manage your password and ensure uniqueness between logins, use a password manager like Bitwarden (which is free and open source). For making a secure but memorable master password, I'm a fan of the Correct Horse Battery Staple method.
Second, since we know this attacker had time to prepare, you should also check for unknown devices logged in to your account. In Discord, this is in the user settings page under Devices:
There is a button at the bottom of that page to log out of all devices, just in case there is one that you don't recognize.
The most damaging thing the hacker did was delete several of the Discord servers the user had ownership of. Fortunately, the inhabitants of the server I frequent grabbed a list of members just in time to rebuild it (in one hell of an impressive barn raising maneuver). So my last pieces of advice are to mitigate the damage and enable rapid rebuilding.
For one, I have a private single-person Discord server in which I jot down notes. I'm probably going to be moving that over to Obsidian, because it would kinda suck if my account got hacked and that server got deleted.
Discord also has a feature for server administrators to generate a template of a server (in the Server Settings, right above Delete Server way at the bottom of the list). Backing up a template can help in restoring a server quickly if needed.
The members of the server also took screenshots of the member list so we could reinvite everyone to the new server. We lost a lot of chat history, and it truly sucks, but we still have the most important thing: the people.
So yeah, this was a pretty shitty thing for the hacker to do! I'm both mad and a little impressed, but mostly mad. Stay safe out there y'all.
