Release Day Shenanigans
Our Discord server was compromised yesterday. Someone decided to rain on our parade of a Release Day and cause some chaos. A developer of ours received a message from someone claiming to have seen our recent interview with Epic Games on YouTube. They stated they were an indie developer like us and requested that we look at his game for feedback. The person said his game was already on itch.io, a legitimate indie game platform like Steam.
Being the kind and helpful person that he is, The dev obliged and tried the person's game. The problem was,* it wasn't a game.* The download was malware that took control of Manny's computer and hijacked his Discord session and who knows what else. He immediately changed the credentials on the dev's account. Since this dev was the server admin, the hacker had the keys to the kingdom and kicked and banned all the Developers and Mods who could stop him.
He then posted to this discord malicious links and continued to spread malware to individuals. If you clicked a link from the compromised account or Discord from a post after our release announcement yesterday then your machine could have been compromised. We know of several other individuals who were also targeted, some resulting in IP bans from Discord.
We were the victim of a very targeted spear phishing attack and has since reformatted the compromised computer and reset all passwords to all accounts. Thankfully none of our personal information on the computer was compromised such as banking accounts. None the less it was a huge hassle to recover.
Recovery
Thankfully he was also able to recover the Discord account, we then unbanned the devs and mods, and deleted all the malicious messages. We are in the process of restoring roles and will then discuss internally how we can prevent such malicious behavior again.
So on one hand as we are now public and free to play we have more eyes on our work which we're very grateful for that obviously is accompanied with some risk. Thank you everyone for your patience!