{
  "family": "maplestory",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nIn a cybersecurity context, detections named \"Maplestory\" do not refer to the legitimate video game itself, but rather to a classification of Trojans and HackTools disguised as \"cheats,\" \"trainers,\" \"aimbots,\" or \"meso generators\" for the popular MMORPG MapleStory. Threat actors heavily target the gaming demographic, bundling severe malware—most commonly password stealers and remote access trojans (RATs)—into these illicit cheating utilities.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe infection vector relies entirely on social engineering and user deception. Gamers actively seek out these files on grey-market forums, Discord servers, or YouTube video descriptions and willingly execute them, often bypassing their own antivirus warnings under the false belief that game cheats trigger \"false positives.\"\n\nUpon execution, the \"cheat\" may actually modify the game's memory (to maintain the illusion), but its primary function is malicious:\n<ul>\n<li><strong>Credential Harvesting:</strong> The most common payload is a specialized Info-Stealer. It targets the user's game login credentials, but also sweeps the system for stored browser passwords, cryptocurrency wallets, and Discord session tokens.</li>\n<li><strong>System Subversion (Rootkits):</strong> Because game cheats inherently require deep system access to read/write to the memory of other processes, the malware often installs a rootkit or malicious driver, giving the attacker Ring 0 (kernel-level) control over the machine.</li>\n<li><strong>Botnet Conscription:</strong> Many game-related trojans silently install cryptocurrency miners (Monero) or conscript the powerful gaming PC into a DDoS botnet.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of \"cheat\" software poses a severe risk to the endpoint. It bypasses the \"human firewall,\" granting the malware deep system privileges. While the initial target may be a gaming account, the ultimate compromise often includes the theft of sensitive personal data, banking credentials, and complete system subversion.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Password Reset:</strong> All passwords stored on the infected machine (game accounts, email, banking, social media) must be considered compromised and reset immediately from a *different*, clean device.</li>\n<li><strong>MFA Enforcement:</strong> Ensure Multi-Factor Authentication (MFA) is enabled on all critical accounts to mitigate the use of stolen session tokens or passwords.</li>\n<li><strong>Endpoint Eradication:</strong> Due to the likelihood of rootkit installation and the user manually bypassing UAC/AV controls, a simple antivirus scan is insufficient. The recommended remediation is a complete bare-metal wipe and re-installation of the operating system.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.MaplestoryCheat",
    "HackTool.Maplestory",
    "PWS.Maplestory"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1056.001",
    "T1014",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:48:19Z",
  "type": "HackTool / Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}