At this time, not much is known about the IceBreaker group, but Security Joes decided to publish a report on their findings and share all captured IoCs (indicators of compromise) to help defenders detect and tackle this threat. The researchers have published a technical report describing the threat actor’s modus operandi and how their backdoor works. YARA rules have also been published to help organizations detect the malware. Additionally, Security Joes recommends companies suspecting a breach with IceBreaker look for shortcut files created in the startup folder and check for unauthorized execution of the open-source tool tsocks.exe. Monitoring the creation of msiexec.exe processes that receive URLs as parameters could also be an indication of compromise just as the execution of VBS scripts and LNK files from the temporary folder.
https://www.bleepingcomputer.com/news/security/hackers-use-new-icebreaker-malware-to-breach-gaming-companies/
