GTA VI-Themed Lures Lead Users to Malware

Summary

Threat actors are exploiting interest in the upcoming Grand Theft Auto VI release by distributing malicious ISO files through SEO poisoning and torrent websites. These files deliver a combination of RATs, infostealers, and ransomware that behaves as a destructive wiper. The campaign appears to primarily target Russian-speaking gamers.

Investigation

Huntress analyzed a malicious ISO file disguised as a leaked GTA6 build inside a sandbox environment. The investigation uncovered a multi-stage infection chain involving fake installers, multiple RATs such as NJRAT and DCRAT, and the Mercurial Grabber infostealer. Researchers also identified Chaos ransomware being used to destroy files rather than demand payment.

Mitigation

Users should avoid downloading cracked, leaked, or unreleased software from untrusted sources. Keeping security tools such as Windows Defender fully updated can help detect the malware families involved. Organizations should also maintain robust endpoint protection to block unauthorized installers and suspicious payload execution.

Response

If compromise is suspected, the affected system should be disconnected from the network immediately. A complete system reimage should be performed to remove all persistence mechanisms and malicious components. User passwords should also be reset, and multi-factor authentication (MFA) enabled across all relevant accounts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully bypassed perimeter defenses and is moving to the final stage of their mission: extortion. After encrypting the user’s data, the Chaos ransomware drops a specific file named read_it.txt into various directories to provide instructions on how to pay the ransom. This simulation mimics the dropping of this specific file to verify if the SOC receives an alert for this specific Chaos Ransomware indicator.

• Regression Test Script:

  # Simulation script to mimic Chaos Ransomware dropping a ransom note
  $TargetDir = "$env:USERPROFILEDocuments"
  $RansomNoteName = "read_it.txt"
  $RansomNoteContent = "YOUR FILES ARE ENCRYPTED. PAY 0.5 BTC TO THE FOLLOWING ADDRESS..."
  
  Write-Host "[+] Simulating Chaos Ransomware: Dropping ransom note in $TargetDir" -ForegroundColor Cyan
  
  try {
      $Path = Join-Path -Path $TargetDir -ChildPath $RansomNoteName
      Set-Content -Path $Path -Value $RansomNoteContent
      Write-Host "[SUCCESS] File created: $Path" -ForegroundColor Green
  }
  catch {
      Write-Host "[ERROR] Failed to create file: $($_.Exception.Message)" -ForegroundColor Red
  }

• Cleanup Commands:

  # Cleanup script to remove the simulated ransom note
  $TargetDir = "$env:USERPROFILEDocuments"
  $RansomNoteName = "read_it.txt"
  $Path = Join-Path -Path $TargetDir -ChildPath $RansomNoteName
  
  if (Test-Path $Path) {
      Remove-Item -Path $Path -Force
      Write-Host "[+] Cleanup complete: $Path removed." -ForegroundColor Green
  } else {
      Write-Host "[-] Cleanup skipped: File not found." -ForegroundColor Yellow
  }