Discord Friend-to-Friend Minecraft Modpack Malware Campaign

This campaign appears to spread through a chain of compromised Discord accounts. Rather than relying on messages from unknown accounts, an attacker compromises a legitimate Discord account and then uses that account to target the person's existing friends. This means the victim receives the malicious message from someone they genuinely know and may have previously spoken to. The compromised account begins with normal conversation before asking whether the victim plays Minecraft. The victim may then be told that their friend has created a Minecraft server or modpack and needs somebody to help test it, sometimes using an innocent explanation such as needing another player for a friend's birthday. The victim is subsequently instructed to install CurseForge, create or sign into an account, and import a supplied Minecraft modpack/ZIP file. In observed examples, files have been presented with names resembling legitimate Minecraft modpacks, such as SurvivalBetter-CurseForge.zip. The supplied content is not simply a normal Minecraft modpack. Analysis indicates that it contains or deploys a malicious executable, with malicious activity extending outside the expected Minecraft or CurseForge environment and into the Windows operating system. Observed behaviour includes persistence through Boot or Logon Autostart Execution / Active Setup (MITRE ATT&CK T1547.014), meaning malicious code can be configured to execute again when the affected user logs into Windows. Analysis has also identified registry modification and querying, enumeration of connected drives, process enumeration, environment/sandbox checks and suspicious use of Windows functionality including AdjustPrivilegeToken, FindShellTrayWindow, SendNotifyMessage, SetWindowsHookEx, and WriteProcessMemory. The apparent propagation method is therefore: Friend's account/system compromised → compromised account contacts existing friends → victim trusts the message because it comes from their real friend → malicious Minecraft content is installed → victim may subsequently be compromised → victim's trusted contacts can then be targeted. This is particularly concerning because the campaign exploits an existing trusted relationship. A victim does not necessarily receive an obviously suspicious unsolicited message; they may be having what appears to be a completely genuine conversation with somebody already on their friends list. There have additionally been reports of extortion following the compromise. Victims have reported individuals identifying themselves as the “Dev7 Gang” threatening to sell, distribute, or leak information and accounts allegedly obtained from compromised systems. Reported ransom demands include approximately $800 to prevent stolen information from being sold and another reported demand of $800 relating to compromised accounts being leaked or distributed. Reports have also described an overall demand of approximately $1,200, indicating that the amounts demanded may vary, be combined differently, or be negotiated between the attackers and individual victims. The reported activity suggests the campaign may therefore involve several stages: social engineering, malware deployment, persistence, information/account theft, further propagation through trusted Discord accounts, and subsequent financial extortion using stolen information as leverage. The “Dev7 Gang” attribution, exact ransom amounts, and the extent of the group's involvement should currently be treated as reported/unconfirmed intelligence unless further independent evidence confirms the attribution. The technical malware behaviour and observed distribution method should be recorded separately from claims regarding the identity of the individuals operating the campaign.