Cybercriminals Gang Threaten Ubisoft to Release Watch Dogs Legion Source Code

The Egregor gang has released 20MB of data supposedly related to Watch Dogs: Legion, the latest installment in Ubisoft’s hit franchise. As of yet, there is no evidence that cybercriminals really own the source code and graphics engine for the game, as they claim.

In two weeks, on October 29, the French publisher Ubisoft plans to release Watch Dogs : Legion, the third installment of one of his successful franchises. But the Egregor gang seems determined to interfere with this process. Cybercriminals claim to own the blockbuster’s source code and graphics engine, and threaten to release it if the video game giant doesn’t respond to their demands. Presumably, this information would not be enough to reproduce the game, but it would give privileged access to the technical back room of the developers and could reveal some design secrets.

As proof of their wrongdoing, the criminals published a small volume (20 MB) of files supposedly linked to Watch Dogs : Legion, on their portal in the dark web, according to ZDNet. But since the game has not yet been released, no one outside of Ubisoft can verify the veracity of the documents. Hackers do not hesitate to exaggerate the sensitivity of the documents in their possession to raise the stakes.

Regardless, Egregor has announced that it will release more files if Ubisoft continues to ignore them, so we should quickly find out if they are bluffing. For their part, researchers of the serious

Today's news (if true) about that company should be not surprising for anyone who is following us from a year ago...
Not remember & as THL is gone, can't ask him if they talked with about the first cases, but what is sure: just some hours ago they still not had a handler on IGP. pic.twitter.com/GWZGX3rqGB

— MalwareHunterTeam (@malwrhunterteam) October 15, 2020

recall that they tried to warn the company earlier in the year about successful phishings against certain executives.

Data could be stolen, but not ransomware

Egregor specializes in ransomware, which it deploys using phishing campaigns designed to trick targets into downloading malware. Once on the computer network, it exfiltrates information, ciphers, and then demands a ransom in exchange for the decryption key. If the company does not want to fall too far behind on production, the victim may be tempted to pay, despite all the problems that payment can cause.

To speed up the negotiation process to their advantage, cybercriminals have over the past two years started gradually releasing their victims’ data as the talks drag on.

But in the case of Ubisoft, Egregor explains to ZDNet that he did not encrypt the data, and that he only stole it. At least the game’s development process hasn’t been slowed down by the mischief. And that’s not all: there is no indication that the leak comes from Ubisoft’s network. The files could have been stolen from the computer of a company employee or from the network of an overly informed service provider.

Crytek (Crysis, CryEngine) even more severely affected

The cybercriminals released, along with the data from Ubisoft, 380MB of Crytek data, a German publisher primarily known for the Crysis video game and the CryEngine 3D engine. The Bleeping Computer was able to confirm that Egregor’s ransomware hit the company’s development department and that its files were encrypted. In detail, the files contain in particular information on Arena of Fate and Warface, two company projects.

The German publisher is therefore in a much more critical situation than its French counterpart, since such an incident will slow down its production chain in any case.

Neither Ubisoft nor Crytek have commented on the cybercriminals’ comments, and neither has mentioned a recent security incident.