Full Report
How a GTA VI leak became cover for a ScreenConnect RAT campaign
Analysis Summary
# Tool/Technique: ScreenConnect (ConnectWise) Abuse
## Overview
Threat actors are capitalizing on the viral hype surrounding the "Cyberleek" GTA VI gameplay leaks to distribute malware. The primary technique involves using social engineering lures (fake playable builds and map assets) to trick users into installing a legitimate but maliciously configured ScreenConnect remote access client. This allows attackers to bypass security software via a signed, trusted application to maintain persistent, unattended access to victim machines.
## Technical Details
- **Type:** Malware / Remote Access Trojan (RAT) via Tool Abuse
- **Platform:** Windows (via MSI installers)
- **Capabilities:** Unattended remote access, file transfer, command execution, and information theft.
- **First Seen:** August 2026 (GTA VI Cyberleek campaign)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (Social engineering via GTA VI leak hype)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (Fake "Cyberleek" build MSI)
- **TA0003 - Persistence**
- T1133 - External Remote Services (Abuse of ScreenConnect for persistence)
- **TA0005 - Defense Evasion**
- T1218 - System Binary Proxy Execution (Using signed ScreenConnect binaries)
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer
- T1071.001 - Application Layer Protocol: Web Protocols (Telegram Bot API for exfiltration/notifications)
## Functionality
### Core Capabilities
- **Unattended Access:** Establishes a persistent guest session to an attacker-controlled relay server without requiring further user interaction.
- **System Profiling:** Uses `api.ipify.org` and `ipapi.co` to collect public IP, geolocation (city, region, country), user agent, and screen resolution prior to infection.
- **C2 Integration:** Utilizes the Telegram Bot API (`api.telegram.org`) as a serverless backend to exfiltrate victim profiles and tracking download events.
### Advanced Features
- **Evasion Tactics:** Implements Cloudflare Turnstile on landing pages to prevent automated analysis by sandboxes and crawlers.
- **Legitimate Infrastructure Abuse:** Hosted on GoDaddy Website Builder platform for rapid domain rotation and high reputation.
- **Social Engineering:** Mimics legitimate leak community behavior, including a "premium access" $100 cryptocurrency scam.
## Indicators of Compromise
- **File Hashes:**
- `9264837d2826e63b1683d1077705b4b71b27c40385655008dce44ab2ff5c4d18`
- `46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab`
- `f87662d5a9fd65adfa3333b416d4b183fcdf3bdccd22fde3dfb65522b69d51c6`
- **File Names:** `Cyberleek_Build.msi`, `GTA6_Beta_Cyberleek.iso`
- **Network Indicators:**
- `cyberleek[.]click`
- `cyberleek[.]info`
- `gg.noktaarts[.]com`
- `instance-wq4wbt-relay.screenconnect[.]com`
- `carperterloure.screenconnect[.]com`
- `176.97.210[.]86`
- `91.230.49[.]19`
- **Behavioral Indicators:**
- Silent installation of ScreenConnect with unique GUIDs (e.g., `e934a059a3e150c6`).
- Network traffic to `api.telegram.org/bot<token>` from a web browser or MSI installer.
## Associated Threat Actors
- **Cyberleek (Lure Identity):** The specific actor behind this ScreenConnect campaign is currently unconfirmed, though they are distinct from the original 2022 Rockstar hacker (Arion Kurtaj).
## Detection Methods
- **Signature-based detection:** Monitor for the specific MSI hashes and ScreenConnect GUIDs listed in IOCs.
- **Behavioral detection:** Flag unexpected outbound connections to known ScreenConnect relay subdomains from non-administrative user machines.
- **Network Monitoring:** Alert on high-frequency calls to `api.telegram.org` or IP enrichment services (`ipify`, `ipapi`) originating from suspicious domains.
## Mitigation Strategies
- **Software Restriction Policies:** Prevent the execution of unauthorized MSI files and remote desktop tools for non-IT personnel.
- **Web Filtering:** Block the specific "Cyberleek" domains and restrict access to unauthorized ScreenConnect relay instances.
- **User Awareness:** Educate users on the risks of downloading "leaked" software or beta builds from unofficial sources (torrents/Telegram).
## Related Tools/Techniques
- **Living off the Land (LotL):** Using legitimate software for malicious purposes.
- **Infostealers:** Often bundled with these RATs to target gaming credentials (Steam, Discord).
- **Lapsus$ Techniques:** Similar use of social engineering and Telegram, though different in execution.