Grand Theft Auto VI hype leads to malware
Source AlienVault OTX General
Description
Threat actors are exploiting anticipation for Grand Theft Auto VI by distributing malicious ISO files disguised as leaked game versions. These fake installers are spread through SEO poisoning, gaming forums, social media, and torrenting sites. The analyzed ISO contains multiple malicious components including several RAT variants (NJRAT and DCRAT), Mercurial Grabber infostealer, Chaos ransomware functioning as a wiper, and Yandex Browser. When executed, the fake installer displays Russian-language messages and deploys malware to %TEMP% folders. The package includes data exfiltration capabilities, credential theft, system control features, and destructive file encryption. Based on Russian language usage throughout the infection chain, the campaign appears to target Russian-speaking gamers. The malware components date back to 2023, suggesting repurposed tools for this opportunistic attack.
Impact
The malware enables attackers to steal credentials, exfiltrate data, gain remote control over infected systems, and perform destructive file encryption that acts as a wiper. This can lead to significant data loss, privacy breaches, and system compromise for victims. The campaign specifically targets gamers seeking unauthorized copies of Grand Theft Auto VI, potentially resulting in widespread infection within this community. The inclusion of multiple malware families increases the attack's versatility and impact.
Defensive guidance
No official patch or fix applies as this is a malware campaign rather than a software vulnerability. Defenders should avoid downloading or executing unauthorized or suspicious game files, especially those claiming to be leaked versions of unreleased games. Users should obtain games only from legitimate sources. Employ endpoint protection capable of detecting RATs, infostealers, and ransomware. Monitor for indicators of compromise such as the provided file hashes and domains. Educate users about risks of SEO poisoning and social engineering in gaming communities. There is no vendor-managed remediation for this threat.
MITRE ATT&CK techniques
- T1566Phishing · Initial Access (opens in a new tab)
- T1047Windows Management Instrumentation · Execution (opens in a new tab)
- T1053.005Scheduled Task/Job: Scheduled Task · Execution, Persistence, Privilege Escalation (opens in a new tab)
- T1059.003Command and Scripting Interpreter: Windows Command Shell · Execution (opens in a new tab)
- T1204User Execution · Execution (opens in a new tab)
Indicators of compromise
Domains 1
- a0700877.xsph.ru