Patchwork Hides Kernel Driver and Crypto Miner in Pirated Game Crack
A 496 MB Football Manager 2024 fake installer attributed to Patchwork bundles a Bring-Your-Own-Vulnerable-Driver exploit and an XMRig miner disguised as a Windows telemetry binary. The campaign pairs a consumer-grade piracy lure with kernel-level defense evasion and a fabricated Microsoft code-signing certificate — an unusually layered tradecraft stack for an actor whose declared goal is espionage.
A 496-megabyte file masquerading as a Football Manager 2024 crack is the entry point for one of the more technically layered campaigns CTX Team has recently dissected — a multi-stage operation attributed to Patchwork that bundles a Bring-Your-Own-Vulnerable-Driver kernel exploit, a cryptocurrency miner dressed as a Windows system binary, and a persistent obfuscation pipeline, all delivered through the oldest social-engineering lure in the book: pirated software.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read