Overview
- Huntress disclosed the campaign in reports published on September 9–10 after analyzing fake GTA6 ISO files shared on torrent sites, forums and social media.
- Victims who mount the ISOs see a gta6installer.exe that uses a GTA5 icon and shows a Russian-language “License not found” popup while malware installs in the background.
- The installer drops multiple remote access trojans (NJRAT and DCRAT), the Mercurial Grabber infostealer that exfiltrates Discord tokens and browser credentials, and a Chaos-family ransomware variant.
- The Chaos payload acts as a wiper by deleting shadow copies, disabling Windows recovery, encrypting small files and overwriting large files while changing the desktop wallpaper and leaving a non-functional ransom note.
- Huntress published full IoCs and advises avoiding pirated downloads, keeping antivirus up to date, isolating suspected machines and fully reimaging compromised systems rather than attempting to clean them.