This campaign leverages the hype around Grand Theft Auto VI by distributing malicious ISO files that masquerade as leaked game versions. The analyzed malware package includes multiple components: RAT variants NJRAT and DCRAT, Mercurial Grabber infostealer, Chaos ransomware functioning as a wiper, and Yandex Browser. Upon execution, the fake installer displays Russian-language messages and deploys malware into the %TEMP% directory. The malware enables credential theft, system control, data exfiltration, and destructive file encryption. The use of Russian language throughout the infection chain suggests targeting of Russian-speaking gamers. The malware components are repurposed tools from 2023, indicating an opportunistic attack exploiting gaming community interest. Distribution methods include SEO poisoning, gaming forums, social media, and torrenting sites. No known exploits in the wild or vendor patches are applicable as this is a malware campaign rather than a software vulnerability.

The malware enables attackers to steal credentials, exfiltrate data, gain remote control over infected systems, and perform destructive file encryption that acts as a wiper. This can lead to significant data loss, privacy breaches, and system compromise for victims. The campaign specifically targets gamers seeking unauthorized copies of Grand Theft Auto VI, potentially resulting in widespread infection within this community. The inclusion of multiple malware families increases the attack's versatility and impact.

No official patch or fix applies as this is a malware campaign rather than a software vulnerability. Defenders should avoid downloading or executing unauthorized or suspicious game files, especially those claiming to be leaked versions of unreleased games. Users should obtain games only from legitimate sources. Employ endpoint protection capable of detecting RATs, infostealers, and ransomware. Monitor for indicators of compromise such as the provided file hashes and domains. Educate users about risks of SEO poisoning and social engineering in gaming communities. There is no vendor-managed remediation for this threat.