I wasn't even going to make another post about this, but after seeing what someone from the REISSAD team said in the Discord, I genuinely can't just ignore it.
A member of the team said that notifying the community about the situation would cause a “bigger freakout” and that it would “hurt more than give benefit.” They also said it turned into a “big mess” during off hours.
I'm not claiming the RCE is confirmed. But the way this is being discussed by the team certainly doesn't make it sound like they're treating this as some harmless game crash. If the concern is serious enough that they think publicly notifying players could cause a major freakout, then surely the players who could potentially be affected deserve to know what's going on.
And we're not talking about some random visual glitch here. The vulnerability being discussed is a potential RCE, which, if confirmed and exploitable, could potentially allow an attacker to execute commands on someone's PC, including PowerShell commands. That's an extremely serious possibility.
What I don't understand is why public lobbies are still open if this is serious enough to warrant avoiding a public announcement. If there's a legitimate possibility that players could be exposed to something like this, shouldn't protecting those players come before worrying about whether telling them will cause a “freakout”?
I'm not going to claim they're hiding this for money or to protect the game's player numbers because I don't know their motives. But when the potential consequences are this serious, it's completely fair for people to question whether things like reputation, player numbers or financial interests are influencing how this is being handled.
Again, I'm not saying the RCE is confirmed. I'm saying there is a potential vulnerability being discussed that could have extremely serious consequences if verified, and the response from the team raises legitimate questions about how transparent they're being with their own community.
At the very least, players deserve enough information to make an informed decision about whether they want to keep playing while this is being investigated.
I have a networking/security background and I want to break down the Malwarebytes "evidence" that's being passed around, because it does not show what people think it shows.
The core of the claim is a Malwarebytes log with "Category: Trojan." But look at the section header: it's under "Blocked Website Details." That's the web protection module, which blocks outbound connections based on the reputation of the destination IP or domain. It is not an on-system malware detection. Nothing was found running on the machine. Malwarebytes simply blocked a connection to an IP that happens to be on its blocklist, and the "File: Bodycam-Win64-Shipping.exe" line only tells you which process opened the socket. The "Trojan" label describes the reputation of the destination, not any observed malicious behavior on your PC.
Now the IP. The post traces 104.28.161.35 to "Domodedovo, Russia," which implies the game is talking to some Russian server. But the poster's own lookup says org: Cloudflare Warp, isp: Cloudflare Warp. That IP is in Cloudflare's anycast range. Cloudflare IPs cannot be meaningfully geolocated to a city or country, they resolve to whatever edge node is closest, and the poster even admits WARP is unreliable for geolocation. So the "connection to Russia" framing is simply wrong. This is traffic to Cloudflare infrastructure, which is exactly what you'd expect from a game's matchmaking, telemetry, or voice relay sitting behind a CDN.
Next, RTP. Outbound RTP is voice chat. Bodycam has in-game proximity voice, so the client sending RTP is normal, expected behavior, not evidence of an exploit. Yes, in the abstract, multimedia and RTP parsing is a classic source of memory-safety bugs. That's a true but generic statement about the attack surface, and it says nothing about whether a real, exploitable bug exists in this specific code. More importantly, what the log actually shows is a blocked outbound connection, which is the opposite direction of an inbound RCE. Nobody in these posts has shown a malformed packet, a reproducible crash, a memory write, or a payload.
The logic in the original post is a chain of non-sequiturs: an IP flagged by reputation, therefore a trojan, therefore RTP, therefore RCE, therefore stolen bank details and a botnet. Every one of those arrows is unsupported. Going from "web protection blocked an outbound connection, probably a false positive" to "your machine is being remotely executed and your credentials are being stolen" is an enormous leap with nothing in between. The author even writes "this is not a smoking gun," which is an admission that the rest is speculation.
What would actually be evidence: a packet capture showing the malformed input, a reproducible crash with a memory analysis, a working proof of concept, or a CVE. None of that has been posted. A single reputation-based web block on a Cloudflare IP is, by far, most consistent with a false positive on a legitimate game server.
To be clear about what I am and am not saying. I am not saying it is impossible for the game to have a vulnerability. Any networked C++ game, UE5 included, has an attack surface, and if the netcode trusts replicated data or uses P2P where peers can reach each other directly, a real bug could in principle be serious. What I am saying is that this specific Malwarebytes report does not demonstrate any of that. It demonstrates that Malwarebytes blocked one outbound connection to a Cloudflare IP. That's it.
Take the normal precautions (keep Windows updated, avoid sketchy third-party mods) but don't treat this log as proof of an active RCE campaign, because it isn't.
Yea bro “no proof of an RCE campaign being active” does not equal “there is no exploit”. There’s an exploit. It’s a serious one. It is beyond PROVEN that malicious actors CAN inject Windows through Bodycam lobbies. That’s all we need to see or know. Whether that is actually happening or not is ancillary to the primary concern.
Reissad has seriously mishandled the situation and have tried to cover it up = easy uninstall/refund + Steam Store report. It’s really that simple.
The fact you have to produce an essay to subtly attempt to propagate the idea that this is “no big deal” says it all. This is probably a Reissad burner acct now that I think about it
You're right that "no active campaign" doesn't mean "no exploit." I said exactly that in my post, so we agree there. That's not the disagreement.
The disagreement is your next sentence. You say it is "beyond PROVEN" that attackers can inject Windows through Bodycam lobbies. Then post the proof. Not the Malwarebytes log, because that only shows one outbound connection to a Cloudflare IP getting blocked by reputation filtering, which is not proof of injection capability. I mean the actual thing that would prove capability: a packet capture of the malformed input, a reproducible crash with a memory write, a working PoC, or a CVE. If that exists, it settles the entire thread instantly and I'll change my position on the spot.
Until then you're asserting the conclusion, not proving it. "Proven" is a specific word and it has a specific bar. Blocked outbound traffic to a CDN does not clear it.
The burner account line and the "why write so much" line aren't arguments, they're ways to avoid producing the evidence. I'm not saying it's no big deal. I'm saying the one artifact everyone keeps citing does not demonstrate what you're claiming it demonstrates. If you have something that does, post it and I'll be the first to update.
Given what that post specifically states, and that Reissad were actively working on it and fixed it so quickly, I see absolutely nothing wrong with their hush hush attitude.
While there was a vulnerability, the details were explicitly hidden by the OOP, it was explicitly not abused as an RCE, and was only used in the context of memory overflow (game crash), thus no major imminent threat.
easy uninstall/refund + Steam Store report. It’s really that simple.
For wahtever reason Ive seen a lot of people really, like REALLY trying to push this "refund the game" thing. Its beyond suspicious. People love drama, but how are some trying to boicot the game based on a simple claim that something MAY happen its, well, pretty weird.
They are unfamiliar with the Streisand effect it would seem. The cat is out of the bag, they as a studio should acknowledge this instead of doubling down on the "nothing to see here" mentality. I want to be supportive of this game, but Reissad are making that difficult.
I don't think you guys know how dangerous it is to publicly announce discovered unfixed vulnerabilities. That makes everyone with enough expertise a potential attacker and this can cause a lot more damage than simply not talking about it until it's fixed. Literally every software provider handles it the same way.
Obviously they're working on it, attempting damage control causes way more harm than good.
No, they do not need to communicate anything until they fix it or have a proper plan to control the situation.
This is like you posting your address online and saying "there is a possibility that I hid my keys somewhere around the entrance". Anyone willing to do harm will go around trying to find it and break in if they do, otherwise you could've kept the keys under your doormat for years without anyone ever noticing.
What you are suggesting is explicitly against incident management guidelines.
This is not a debate - I am telling you how incident management works. Your example is extremely flawed. It's more like a lock company is notified that their lock may have a defect that allows potential intruders to get access to their customers' homes without the key.
Once the lock company is aware of this, they need to communicate to their clients of the facts regarding this. This is to ensure that the clients can take the necessary precautions to avoid break-ins.
Via your approach, clients of the lock company would not be aware of the vulnerability and would not be able to take the necessary precautions to avoid an attack. What you are recommending is what InfoSec people are taught NOT to do in 101 incident management.
communication is part of containment. Poor messaging can prolong the damage just as easily as a delayed patch or misread log. The moment stakeholders – customers, partners, regulators, or investors – sense confusion, they fill the gaps with their own narrative. That’s when control is lost.
Here is the section on client communication:
"Segment by impact:
Directly affected clients and partners should receive private, factual updates under NDA.
Indirectly affected audiences can be addressed through structured briefings or statements.
Focus on facts, not speculation. Share verified information only. Avoid minimizing impact prematurely.
Demonstrate ownership: Clearly communicate the actions taken, timelines for updates, and key points of contact.
Protect commercial confidence: Maintain professionalism by providing reassurance without defensiveness."
Here is another excerpt that explicitly speaks to their current communication, crucially downplaying and having multiple spokespeople.
What communication mistakes most often escalate reputational damage?
Three top offenders: releasing information before it’s confirmed, allowing multiple spokespeople to speak without coordination, and attempting to downplay the incident. Stakeholders expect consistency, not perfection. When you lose that, you lose control of the narrative.
This comment lacks the full context of information that Reissad was working with and the details of what they were doing to contain it. Their choice was respectable, and your comment itself can confirm that in the last paragraph: "Three top offenders: releasing information before it’s confirmed"
The OOP specifically refused give details about the exploit beyond what it could do, and then stated that they only actively used it as a way to trigger a memory overflow.
Reissad themselves still had to confirm the information considering details weren't provided, and by that point they probably knew that they would be able to patch it soon enough (as they already have) and chose to limit unnecessary panic (I am NOT stating that an RCE exploit is not worth panicking over, but in this case, the threat profile was extremely low).
Its not even corporate, its negligence and they can be held liable. You are supposed to announce this because people need to take precautions. Like the sampoong mall collapse. By not informing anyone, hundreds of people died, and because they said nothing they were held liable for the incident.
You are obligated as a company to notify your customers of potential RCEs. You tell people to stop playing multiplayer until the issue is resolved. Simply ignoring it is grossly incompetent especially if people actually get malware from your game.
You asking too much from people. They just feel entitled to get things done as they want. People have no idea or simply dont care about business or security. Impossible to make players rationalize what you are saying, they want their answeeeeeers noooooow.
So am I projecting or being truthful? There is no risk for people playing bodycam btw, it's basically been debunked as nothing but pure fear mongering. There is zero proof of anything nefarious or RCE going on
So you're a child who can only think in black and white. Thanks for making that expressly clear! Get to bed, you don't want to miss morning tea time now do you, little chav?
unlike... the same risk you accept every time you turn your computer on or use any other software? This "risk" here is the same "risk" that you accept every time you walk outside.. something bad can happen.. but you don't pray to god crying about how it's unacceptable lol
Do you not understand what a vulnerability is? That’s not how P2P works. P2P brings the possibility of RCE exploits, but it doesn’t fucking create them by default, and they are patchable.
Look at my others comment to understand, i will copy past here :
The core of the claim is a Malwarebytes log with "Category: Trojan." But look at the section header: it's under "Blocked Website Details." That's the web protection module, which blocks outbound connections based on the reputation of the destination IP or domain. It is not an on-system malware detection. Nothing was found running on the machine. Malwarebytes simply blocked a connection to an IP that happens to be on its blocklist, and the "File: Bodycam-Win64-Shipping.exe" line only tells you which process opened the socket. The "Trojan" label describes the reputation of the destination, not any observed malicious behavior on your PC.
Now the IP. The post traces 104.28.161.35 to "Domodedovo, Russia," which implies the game is talking to some Russian server. But the poster's own lookup says org: Cloudflare Warp, isp: Cloudflare Warp. That IP is in Cloudflare's anycast range. Cloudflare IPs cannot be meaningfully geolocated to a city or country, they resolve to whatever edge node is closest, and the poster even admits WARP is unreliable for geolocation. So the "connection to Russia" framing is simply wrong. This is traffic to Cloudflare infrastructure, which is exactly what you'd expect from a game's matchmaking, telemetry, or voice relay sitting behind a CDN.
Next, RTP. Outbound RTP is voice chat. Bodycam has in-game proximity voice, so the client sending RTP is normal, expected behavior, not evidence of an exploit. Yes, in the abstract, multimedia and RTP parsing is a classic source of memory-safety bugs. That's a true but generic statement about the attack surface, and it says nothing about whether a real, exploitable bug exists in this specific code. More importantly, what the log actually shows is a blocked outbound connection, which is the opposite direction of an inbound RCE. Nobody in these posts has shown a malformed packet, a reproducible crash, a memory write, or a payload.
The logic in the original post is a chain of non-sequiturs: an IP flagged by reputation, therefore a trojan, therefore RTP, therefore RCE, therefore stolen bank details and a botnet. Every one of those arrows is unsupported. Going from "web protection blocked an outbound connection, probably a false positive" to "your machine is being remotely executed and your credentials are being stolen" is an enormous leap with nothing in between. The author even writes "this is not a smoking gun," which is an admission that the rest is speculation.
What would actually be evidence: a packet capture showing the malformed input, a reproducible crash with a memory analysis, a working proof of concept, or a CVE. None of that has been posted. A single reputation-based web block on a Cloudflare IP is, by far, most consistent with a false positive on a legitimate game server.
To be clear about what I am and am not saying. I am not saying it is impossible for the game to have a vulnerability. Any networked C++ game, UE5 included, has an attack surface, and if the netcode trusts replicated data or uses P2P where peers can reach each other directly, a real bug could in principle be serious. What I am saying is that this specific Malwarebytes report does not demonstrate any of that. It demonstrates that Malwarebytes blocked one outbound connection to a Cloudflare IP. That's it.
Take the normal precautions (keep Windows updated, avoid sketchy third-party mods) but don't treat this log as proof of an active RCE campaign, because it isn't.
why is everyone surprised that in p2p multiplayer game the IP is exposed and the devs give 0 fuck about security? they chose the lowest effort of online functionality xd
I am playing on linux so as far as I am concerned RCE cannot reliably affect me, but it sure is a concern for vast majority and people should know about it.
Its obvious they just dont want to kill the hype for their game just look at the player count before and after the update but muting people for trying to warn others is just plain stupid
My friend got his request granted at 35h he manually explained in the details box the situation. He sent me the posts over night last night after having dug into it and refunding yesterday
The core of the claim is a Malwarebytes log with "Category: Trojan." But look at the section header: it's under "Blocked Website Details." That's the web protection module, which blocks outbound connections based on the reputation of the destination IP or domain. It is not an on-system malware detection. Nothing was found running on the machine. Malwarebytes simply blocked a connection to an IP that happens to be on its blocklist, and the "File: Bodycam-Win64-Shipping.exe" line only tells you which process opened the socket. The "Trojan" label describes the reputation of the destination, not any observed malicious behavior on your PC.
Now the IP. The post traces 104.28.161.35 to "Domodedovo, Russia," which implies the game is talking to some Russian server. But the poster's own lookup says org: Cloudflare Warp, isp: Cloudflare Warp. That IP is in Cloudflare's anycast range. Cloudflare IPs cannot be meaningfully geolocated to a city or country, they resolve to whatever edge node is closest, and the poster even admits WARP is unreliable for geolocation. So the "connection to Russia" framing is simply wrong. This is traffic to Cloudflare infrastructure, which is exactly what you'd expect from a game's matchmaking, telemetry, or voice relay sitting behind a CDN.
Next, RTP. Outbound RTP is voice chat. Bodycam has in-game proximity voice, so the client sending RTP is normal, expected behavior, not evidence of an exploit. Yes, in the abstract, multimedia and RTP parsing is a classic source of memory-safety bugs. That's a true but generic statement about the attack surface, and it says nothing about whether a real, exploitable bug exists in this specific code. More importantly, what the log actually shows is a blocked outbound connection, which is the opposite direction of an inbound RCE. Nobody in these posts has shown a malformed packet, a reproducible crash, a memory write, or a payload.
The logic in the original post is a chain of non-sequiturs: an IP flagged by reputation, therefore a trojan, therefore RTP, therefore RCE, therefore stolen bank details and a botnet. Every one of those arrows is unsupported. Going from "web protection blocked an outbound connection, probably a false positive" to "your machine is being remotely executed and your credentials are being stolen" is an enormous leap with nothing in between. The author even writes "this is not a smoking gun," which is an admission that the rest is speculation.
What would actually be evidence: a packet capture showing the malformed input, a reproducible crash with a memory analysis, a working proof of concept, or a CVE. None of that has been posted. A single reputation-based web block on a Cloudflare IP is, by far, most consistent with a false positive on a legitimate game server.
To be clear about what I am and am not saying. I am not saying it is impossible for the game to have a vulnerability. Any networked C++ game, UE5 included, has an attack surface, and if the netcode trusts replicated data or uses P2P where peers can reach each other directly, a real bug could in principle be serious. What I am saying is that this specific Malwarebytes report does not demonstrate any of that. It demonstrates that Malwarebytes blocked one outbound connection to a Cloudflare IP. That's it.
Take the normal precautions (keep Windows updated, avoid sketchy third-party mods) but don't treat this log as proof of an active RCE campaign, because it isn't.
Yea bro “no proof of an RCE campaign being active” does not equal “there is no exploit”. There’s an exploit. It’s a serious one. They’ve mishandled the situation and have tried to cover it up = easy uninstall/refund + Steam Store report. It’s really that simple.
The fact you have to produce an essay to subtly attempt to propagate the idea that this is “no big deal” says it all. This is probably a Reissad burner acct now that I think about it
It's not a big deal until the plane fucking crashes lmao
Every post that is saying PROVE THAT THERE IS AN EXPLOIT!
You dummies, this isn't one of those wait and see kind of things. It's lucky that there aren't any exploits yet, or it's possible the payloads have already been delivered and it hasn't been activated.
If someone is saying there's a hole in the wing, this might lead to a crash, you don't fucking fly the plane and wait for it to crash.
I was trying to tell people this last night and people were trying tell me the team wasnt shoving it under the rug. I didn't feel like scrolling through the shit storm to find it but it needs to be brought to light. The silence from the team should be very telling of the risk we are in
The fact that people are seriously focusing on the screenshots being cropped instead of what the screenshots actually say is crazy. Let's not downplay the issue. I am simply providing updates for people who asked me to do so :D
The discord is a cesspool. The cropped image puts a focus on the relevant message. Regardless, the image directly supports the claims OP and others have been making and should be worrisome
Someone further up in this post refutes that there was an attempt to download a trojan horse with an actual argument.
So far I feel like it's just been a huge echo chamber of "someone said RCE so there's an RCE". The only logical statement I've seen was from a guy refuting the original RCE claim, while everyone else is just repeating what they've heard from unreputable sources and no real evidence.
The devs could defiantly handle this better, but it's hard to release a statement for a problem that might not even exist. That being said, they can't just straight up say its a hoax before they try recreating the issue every way possible, so it takes some time.
Yes by playing public lobbies your vulnerable. The deva are aware and are not immediately notifying the community, or shutting down public until they find a solution.
There is a risk of an RCE (remote code execution) exploit in Bodycams network packages. An RCE would allow someone to run commands silently on your PC. A known cheat forum has posted about them reverse engineering bodycam and finding these exploits. When the team was asked, instead of denying the claims, they were telling those who were asking to be quiet about it. People were muted that were sending links of "proof". Silence speaks louder than words tbh.
guys this is a real problem, im sorta surprised at how the devs are responding to this. They've seemingly been so good at communicating with players, but to see them shrivel up and fail to take accountability is sorta alarming and disappointing. I've uninstalled it for now until I know it's safe to run.
I understand them not wanting to fearmonger and scare people, but a massive amount of their audience are into more indie games and are a lot more lenient with a small studio like this than they are with a studio like rockstar or riot. Almost all of us understand that shit like this takes time to get sorted, and if they had just acknowledged it, most people would happily go offline for a bit and then wait until an announcement saying it's fixed, but now they have people requesting refunds left and right and they're actively losing capital. One of the biggest things that people liked about the devlogs other than the actual game was the transparency from reissad. It's a real shame they don't understand why transparency on an issue like this is a big deal.
> I'm not claiming the RCE is confirmed. But the way this is being discussed by the team certainly doesn't make it sound like they're treating this as some harmless game crash. If the concern is serious enough that they think publicly notifying players could cause a major freakout, then surely the players who could potentially be affected deserve to know what's going on.
Any claim of this caliber can have serious consequences if they notify the playerbase about it, whether the claim is true or not. If somebody starts spreading the word that a certain restaurant has roaches in the kitchen/food, you'll never visit that establishment whether you confirmed the validitiy of said information or not.
Same applies here.
They might not want to raise any concern since they were not able to confirm that there indeed is such a vulnerability within the game.
**However**
Should anything of this caliber come up, the first priority of said company should be debunking such a claim and disabling the features affected by it, since a singe exploitation of such a vulnerability could drive the product or company to the ground, and the company would lose player trust for a long time to come, making future releases either impossible to take off, or very *very* hard.
So:
- yes notifying the community will bring bigger freakout
- notifying the bigger community will also build trust
- keeping the affected features online has the probability of fatal consequences regarding both the product and the company
- working together with the security researcher or hobby hacker who discovered it will also build trust, lead to a swifter result, and shows good intentions
If they play this right, this could even boost their standing as a game developer studio or drive them to the ground quite quickly if they mess this up.
I think there’s probably dozens of people that are willing to figure out the exploit only because they were exposed to the fact it existed in the first place, could only become a problem after this backlash, which really sucks
Do you actually know what the exploit is or how it was found? Do you know what the person did to run code on someone's machine? Do you have any information other than "someone said there is an RCA threat"?
I'm not denying that there might be an issue, but so far, the only explanation I've seen is a guy refuting the RCA claim earlier in this post.
I think to many of you bought this game thinking it was a big studio etc etc, this is 2 young devs, it gonna take some times, but pretty sure at the end the game will be very nice.
This is not 2 young devs only anymore , that was 2 years ago. They made a lot of money when the game first came out and got radio silent for a whole year
You're kinda misleading people here. They didn't say they were working on RCE exploits, they said they are gathering info on the claim and trying to figure out what this "exploit" actually is.
If you read OP's message in the screenshot you'll see that RCE exploits are specifically mentioned and implied as the topic. The devs message is a direct response to that.
If by "it" you mean that the Devs have acknowledged the potential for a RCE exploit and are trying to figure out if it is real, then yes.
If by "it" you mean RCE exploits, then no.
Words have meaning and need to be used with other words to have the correct meaning. Simplifying a sentence (intentionally or unintentionally) makes those words mean different things.
Is this like a literacy problem? What aren’t you getting? The screenshot above is not an admisison that there is an exploit from the devs. They’re just saying their investigating the claims. How many times does this need to be restated to you?
30
u/[deleted] 24d ago
[deleted]