{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The use of 'leaked' software hype to distribute multifunctional malware is a persistent threat to corporate identity; confirming the absence of these RATs protects the enterprise fleet." }, "name": "GTA 6 Hype: RAT C2 and Data Theft", "type": "investigation", "labels": [ "hunt", "attack.t1090.003", "attack.t1572", "attack.t1555", "attack.t1115", "attack.t1071.001" ], "series": { "slug": "grand-theft-auto-vi-hype-leads-to-malware", "index": 2, "title": "Grand Theft Auto VI hype leads to malware", "total": 2 }, "related": [ { "hunt": "gta6-hype-wiper-logic", "reason": "This hunt focuses on C2 and exfiltration; the wiper functionality (encryption and Shadow Copy deletion) is a distinct behavioral phase.", "relation": "out-of-scope-alternative" }, { "hunt": "gta6-malicious-installer-wiper-activity", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt combines behavioral path execution, stack-counted prevalence, and network indicator matching to find variants that a static hash-based rule would miss.", "coverage": [ { "stage": "rat-c2-and-tunneling", "steps": [ "suspicious-path-execution", "binary-rarity-baseline", "c2-network-activity" ], "status": "covered" }, { "stage": "infostealer-credential-theft", "steps": [ "suspicious-path-execution", "c2-network-activity" ], "status": "covered" }, { "stage": "initial-access-seo-poisoning", "reason": "Belongs to another part of the 'Grand Theft Auto VI hype leads to malware' series.", "status": "out_of_scope" }, { "stage": "fake-installer-deployment", "reason": "Belongs to another part of the 'Grand Theft Auto VI hype leads to malware' series.", "status": "out_of_scope" }, { "stage": "wiper-impact-and-recovery-inhibition", "reason": "Belongs to another part of the 'Grand Theft Auto VI hype leads to malware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Initial Access via SEO Poisoning", "slug": "initial-access-seo-poisoning", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "gta6installer.exe", "https://clck.ru/34uJnp", "Large ISO files masquerading as GTA6" ] }, { "name": "Fake Installer Execution and Staging", "slug": "fake-installer-deployment", "tactic": "execution", "observables": [ "%TEMP%\\checkinternetconnection.bat", "%TEMP%\\find.vbs", "%TEMP%\\licensechecker.exe", "%TEMP%\\rockstar.exe", "%TEMP%\\steam.exe", "%TEMP%\\rockstargames.exe", "%TEMP%\\YandexPackLoader.exe", "C:\\Windows\\System32\\drivers\\etc\\hosts", "WScript.exe find.vbs" ] }, { "name": "RAT Command and Control with Tunneling", "slug": "rat-c2-and-tunneling", "tactic": "command-and-control", "techniques": [ "T1090.003", "T1572" ], "observables": [ "7.tcp.eu.ngrok.io:12684", "35.157.111.131", "3.68.56.232", "3.67.15.169", "a0700877.xsph.ru", "141.8.197.42", "any.ran.exe", "UserOOBEBroker.exe" ] }, { "name": "Infostealer Collection and Exfiltration", "slug": "infostealer-credential-theft", "tactic": "credential-access", "techniques": [ "T1555", "T1115" ], "observables": [ "adminapp.exe", "Mercurial Grabber", "https://discord.com/api/webhooks/995445114254139543/NmpxQmuBCD6sm3UkVvupGtx-Y0M_A86oJHp00O-l8F4jakfVhqFXzMBoy1uBDdj2rBLc" ] }, { "name": "Wiper Impact and Recovery Inhibition", "slug": "wiper-impact-and-recovery-inhibition", "tactic": "impact", "techniques": [ "T1486", "T1490" ], "observables": [ "gta6.exe", "%USERPROFILE%\\AppData\\Roaming\\svchost.exe", "vssadmin.exe delete shadows /all /quiet", "bcdedit /set {default} recoveryenabled No", "read_it.txt", "YOU HAVE BEEN HACKED BY THE ASHA HACKER TEAM!" ] } ], "summary": "Threat actors are exploiting Grand Theft Auto VI hype by distributing malicious ISO files via SEO poisoning and gaming forums. The infection chain uses a fake installer to deploy a variety of malware including NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware, which acts as a wiper to destroy user data while inhibiting system recovery." }, "severity": "high", "rationale": "Start with end-user workstations where users are most likely to search for game leaks. Focus on the last 14 days following any high-profile game announcements.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is leveraging Grand Theft Auto VI hype to deploy RATs and infostealers that use ngrok tunnels for command and control and Discord for credential exfiltration.", "parameters": { "c2_ips": { "from": { "ref": "huntress-gta6", "kind": "article", "observed": "2026-09-09" }, "type": "list[ip]", "default": [ "35.157.111.131", "3.68.56.232", "3.67.15.169", "141.8.197.42" ], "description": "C2 IP addresses for NJRAT and DCRAT identified in the report." }, "c2_domains": { "from": { "ref": "huntress-gta6", "kind": "article", "observed": "2026-09-09" }, "type": "list[domain]", "default": [ "7.tcp.eu.ngrok.io", "a0700877.xsph.ru", "discord.com" ], "description": "C2 domains and hostnames observed in the malware traffic." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-09-09" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the hunt; leave empty for fleet-wide." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2026-09-09" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/fake-gta6-download-malware-analysis", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/fake-gta6-download-malware-analysis", "name": "Huntress \u2014 Grand Theft Auto VI hype leads to malware" } ], "blind_spots": [ { "id": "missing-network-telemetry", "risk": "A host without network logging will only be flagged based on binary rarity, which is a lower confidence signal without network correlation.", "stage": "rat-c2-and-tunneling", "question": "whether the host communicated with the C2 servers", "requires": "hb_network_connection from all endpoints" }, { "id": "tls-inspection-gap", "risk": "Without TLS inspection, the analyst can see the connection to Discord but cannot confirm the nature of the exfiltrated data.", "stage": "infostealer-credential-theft", "question": "what specific credentials were sent to Discord webhooks", "requires": "hb_http_activity with full URL/Payload inspection" } ] }, "name": "GTA 6 Hype: RAT C2 and Data Theft", "description": "This hunt identifies post-infection activity from fake GTA 6 installers by targeting the C2 and exfiltration phases. It looks for processes running from temporary paths that communicate with known malicious infrastructure or Discord webhooks. The hunt uses fleet-wide prevalence to isolate unique malware binaries from legitimate installer noise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "grand-theft-auto-vi-hype-leads-to-malware", "index": 2, "title": "Grand Theft Auto VI hype leads to malware", "total": 2 }, "coverage": [ { "stage": "rat-c2-and-tunneling", "steps": [ "suspicious-path-execution", "binary-rarity-baseline", "c2-network-activity" ], "status": "covered" }, { "stage": "infostealer-credential-theft", "steps": [ "suspicious-path-execution", "c2-network-activity" ], "status": "covered" }, { "stage": "initial-access-seo-poisoning", "reason": "Belongs to another part of the 'Grand Theft Auto VI hype leads to malware' series.", "status": "out_of_scope" }, { "stage": "fake-installer-deployment", "reason": "Belongs to another part of the 'Grand Theft Auto VI hype leads to malware' series.", "status": "out_of_scope" }, { "stage": "wiper-impact-and-recovery-inhibition", "reason": "Belongs to another part of the 'Grand Theft Auto VI hype leads to malware' series.", "status": "out_of_scope" } ], "rationale": "An adversary is leveraging Grand Theft Auto VI hype to deploy RATs and infostealers that use ngrok tunnels for command and control and Discord for credential exfiltration.", "blind_spots": [ { "id": "missing-network-telemetry", "risk": "A host without network logging will only be flagged based on binary rarity, which is a lower confidence signal without network correlation.", "stage": "rat-c2-and-tunneling", "question": "whether the host communicated with the C2 servers", "requires": "hb_network_connection from all endpoints" }, { "id": "tls-inspection-gap", "risk": "Without TLS inspection, the analyst can see the connection to Discord but cannot confirm the nature of the exfiltrated data.", "stage": "infostealer-credential-theft", "question": "what specific credentials were sent to Discord webhooks", "requires": "hb_http_activity with full URL/Payload inspection" } ], "scoping_notes": "Start with end-user workstations where users are most likely to search for game leaks. Focus on the last 14 days following any high-profile game announcements.", "beyond_detection": "This hunt combines behavioral path execution, stack-counted prevalence, and network indicator matching to find variants that a static hash-based rule would miss." } }, { "id": "suspicious-path-execution", "type": "query", "label": "Execution from temporary and default user paths", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%\\users\\default\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify processes launching from %TEMP% or C:\\Users\\Default which are the primary execution stages for this malware bundle.", "expected_signal": "A list of processes running from user-writable paths. Most will be legitimate installers, which the prevalence step will filter." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Execution from temporary and default user paths", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%\\users\\default\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of processes running from user-writable paths. Most will be legitimate installers, which the prevalence step will filter.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "binary-rarity-baseline", "type": "query", "label": "Prevalence of binaries in temporary paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%\\users\\default\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 3", "surface": "hb_process_activity", "description": "Filter the lead results by identifying binaries that are rare across the fleet, suggesting they are malware variants rather than enterprise software.", "expected_signal": "A stack-counted list of binaries; paths seen on 3 or fewer hosts are the primary indicators of opportunistic malware." }, "parents": [ { "id": "suspicious-path-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Prevalence of binaries in temporary paths", "reads": [ "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%\\users\\default\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A stack-counted list of binaries; paths seen on 3 or fewer hosts are the primary indicators of opportunistic malware.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "c2-network-activity", "type": "query", "label": "Malicious C2 and ngrok network activity", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_hostname, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Match host connections to the reported RAT infrastructure and identify potential Discord data exfiltration.", "expected_signal": "Outbound connections to AWS, ngrok, or Discord hosts. Silence proves absence only for the specified indicators." }, "parents": [ { "id": "suspicious-path-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Malicious C2 and ngrok network activity", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_hostname", "dst_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_hostname, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Outbound connections to AWS, ngrok, or Discord hosts. Silence proves absence only for the specified indicators.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-evidence", "type": "analytic", "label": "Triage binary and network evidence", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "suspicious-path-execution", "binary-rarity-baseline", "c2-network-activity" ], "objective": "Identify high-confidence compromises by finding rare binaries in temporary directories that are responsible for the detected C2 or Discord traffic.", "description": "Weigh process rarity against network signals.", "max_iterations": 5, "expected_signal": "A prioritized list of malicious hosts and processes.", "success_criteria": "A verdict of malicious or suspicious per host, citing specific rare binaries and their associated network activity." }, "parents": [ { "id": "binary-rarity-baseline", "kind": "merge" }, { "id": "c2-network-activity", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict confirms a rare binary is communicating with malicious infrastructure", "condition": "the triage verdict confirms a rare binary is communicating with malicious infrastructure", "blind_spot": "missing-network-telemetry", "confidence": "high", "description": "Direct action based on agent analysis.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-evidence" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate host and preserve evidence", "config": { "target": "endpoint", "description": "Contain the threat and prevent further exfiltration.", "instructions": "Isolate the host from the network immediately to prevent further exfiltration. Preserve the identified rare binary for reverse engineering and forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Analyst review and exfiltration check", "config": { "assignee": "analyst", "description": "Examine the scope of stolen credentials and confirm initial infection source.", "instructions": "Review the host's activity leading up to the infection. Check hb_http_activity for specific Discord webhook paths used and confirm whether tokens or passwords were exfiltrated. Update the c2_domains parameter if new infrastructure is discovered." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document the hunt result.", "instructions": "Document the absence of the GTA 6 malware bundle. Record any benign temporary installers that were stack-counted for future exclusion lists." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }