PSA: Valheim Discord Got Hacked

[Munin]

Time of incident: The breach began on 29th Jan. around 18:58 / 6:58pm CET and was stopped 10 minutes after.

What happened: Multiple Discord accounts with admin permissions were hijacked. A phishing link was spammed containing an infected file. Additionally, an attempt was made to delete all channels and ban users.

Current status: Iron Gate restored the Discord. The messages, however, are lost. Users who were falsely banned by the hijackers are unbanned. Thank you for you patience and understanding.

What is important for me?

There is no longer any danger, you can join the Discord again using the old invite url .gg/valheim.

[MisticHD]

Ursprungligen skrivet av Luckyleol:

Ursprungligen skrivet av MisticHD:

What was the reason for this, it's one of the best game I have, the devs are chill and all... I guess some assoles just want to see the world burn.
And of course those were russian hackers lol

notoriety, fame, bragging rights. maybe getting some users that has their debit/credit connected and mass buy nitro to resell. these hacks aren't complex and these hackers are probably script kidies using exploits that others has found but hasn't been patched.

That's just sad life you have to have if you crave validation so much.

[TheTimelessOne26]

Ursprungligen skrivet av ChrisWWood:

I unfortunately clicked the links on it but then left the fake servers afterwards

The discord link looks safe. It is more to do with the game itself that they are trying to download off of that fake one. And spamming. Just to be safe. I still recommend you change your discord password.

[Forien]

Ursprungligen skrivet av edem:

Well, I'm pretty sure it's not the dev who got hacked... I suspect the LGHDTV+ communityPERSON :D

I have screenshot of the initial post (as I showed it to my friends I was on voip at the moment) and it is the person with Developer role that posted the malware links initially. Not sure what their actual role was in the company, but going purely from Discord Roles, it was a dev.

Not gonna post the screen because I don't want them to get hate.

[ChrisWWood]

The links were server invites to a fake new official discord and one called Planets for a giveaway. I left the real official server that is locked down by mistake.

[TheTimelessOne26]

Ursprungligen skrivet av Forien:

Ursprungligen skrivet av edem:

Well, I'm pretty sure it's not the dev who got hacked... I suspect the LGHDTV+ communityPERSON :D

I have screenshot of the initial post (as I showed it to my friends I was on voip at the moment) and it is the person with Developer role that posted the malware links initially. Not sure what their actual role was in the company, but going purely from Discord Roles, it was a dev.

Not gonna post the screen because I don't want them to get hate.

Ya. I can also confirm that. It was kinda funny because the person that hacked them was having trouble banning people.

[FlowerHugger]

Ursprungligen skrivet av TheTimelessOne26:

Ursprungligen skrivet av Elwi:

It is most likely to stop possible spread of the stolen discord vanity link

That is a more reasonable answer. Considering the official discord link links to that fake one now. From the looks of it.

Nuking seem the safest option, but it's the most painful option.
I personally would nuke the server for people's safety. The longer the hackers run amok in the server, the worse it's going to get.

[Kaleidodragon]

Such a shame they are probably going to lose everything they had in the Discord, but it's better than leaving people vulnerable to future exploits.

[TheTimelessOne26]

Ursprungligen skrivet av Captain Flower:

Ursprungligen skrivet av TheTimelessOne26:

That is a more reasonable answer. Considering the official discord link links to that fake one now. From the looks of it.

Nuking seem the safest option, but it's the most painful option.
I personally would nuke the server for people's safety. The longer the hackers run amok in the server, the worse it's going to get.

That was more in reference to the subreddit than the discord.

[Deathtome]

i saw this ♥♥♥♥ happen in real time, even got some good pictures of it and shared them on twitter

[Razaah !!!!]

Ursprungligen skrivet av Shonack:

Devs, remove the discord invite link from the store page @Munin

Kinda wild that that wasnt one of the first things they would do.
They also havent posted any kind of PSA to twitter either.

//EDIT: Their twitter also has an invite link to the now compromised server.
People be slacking

[exoLL]

I sadly downloaded and ran the .exe from the hacker's link, anyone knows what kind of Malware that is?

What should I do?

[Shonack]

Ursprungligen skrivet av Munin:

Time of incident: The breach began today around 19:05 / 7:05pm CET.
Status: Issue identified. Server in lockdown.

Please do not click on any links sent on the Discord!

Remove the discord invite link from the store page. It's embedded in the "discord"picture.

[Forien]

Ursprungligen skrivet av Elias:

I sadly downloaded and ran the .exe from the hacker's link, anyone knows what kind of Malware that is?

What should I do?

No idea, but probably the "least" dangerous one would be malware that steals your discord credentials.
At worst it could be botnet or ransomware.
I would advise total disk format.

[TheTimelessOne26]

Ursprungligen skrivet av Elias:

I sadly downloaded and ran the .exe from the hacker's link, anyone knows what kind of Malware that is?

What should I do?

Someone posted something about that in the subreddit. But I don't remember what it was.

[Shonack]

and everyone should remove the authorized app "Security" from their settings, if you first allowed it.