Network Addon Mod 48 on ModDB | Potential Security Issue

Security Breach

On October 4, 2024, a hacker hacked the NAM Team account of ModDB by uploading a version of NAM 48 that contains a trojan virus

Version 48.1 was uploaded to ModDB where the hacker modified the bat file that automated the installation of the 4GB Patch and automatically started the NAM java installer. A link to a version.cpl file was inserted in the bat file code, which is the main vector of the Trojan virus infecting your computer.

Only thanks to a report today we have discovered the security incident and are acting quickly as well as performing investigations on how it was possible and future actions to be taken

The mode of attack is very similar to the security incident that occurred in Cities Skylines 2 and so we are thinking that the affected users may be those who have cryptocurrency but we cannot confirm this until fully investigated.

The affected users are all people who have downloaded to Simtropolis and ModDB and use Windows and Linux  as their operating system. We recommend actively running antivirus scans if you consider you have been infected and possibly changing passwords as well as enabling 2FA on your accounts

Mitigation Damage

Currently the Simtropolis download of NAM 48 has been redirected to the SC4E version.

NAM lite version is safe. They did not require corrective action

We have suspended our collaboration with NAM Team and ModDB indefinitely. We will re-evaluate this decision when we feel that the security of ModDB is much improved

Results of investigation

Currently, the NAM Team is investigating the malicious nature of the file and is working with the ModDB Team to resolve the problem and the security flaws that were found

The ModDB Team is investigating how this cyber attack could happen.

We will update this Thread with further information as it becomes available.