Malicious NuGet Packages Disguised as Game Cheats Deploy Remote Access Malware (pepesoft.exe) — Threadlinqs Intelligence
As of 2026-07-15, Malicious NuGet Packages Disguised as Game Cheats Deploy Remote Access Malware (pepesoft.exe) is a critical-severity supply chain threat attributed to pepesoft (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 39 indicators of compromise.
Threat ID: TL-2026-1352 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: pepesoft · Russia · FINANCIAL
Socket's Threat Research Team identified 11 malicious NuGet DotnetTool packages, all published by the account pepegit666, posing as cheats/bots/management panels for role-play games (Albion Online,
On July 14, 2026, Socket's Threat Research Team (analyst Kush Pandya) published research on 11 malicious NuGet packages, all of the `DotnetTool` package type and all published under the single account `pepegit666`: albion-x-x, amazing-x-x, calc-x-x, grandrp-x-x, gta5rp-x-x, l2-x-x, majestic-x-x, rmrp-x-x, rusfish4-x-x, throne-x-x, and trigger-x-x. Each masquerades as a cheat, bot, or server-management panel for a specific Russian-speaking role-play (RP) gaming community — Albion Online, an unrelated 'Amazing RP', GTA5RP, GrandRP, Lineage 2, Majestic RP, RMRP, Russian Fishing 4, and Throne and Liberty — installed by victims via `dotnet tool install`.
All 11 packages share an identical first-stage .NET downloader assembly (albion.dll, amazingrp.dll, calculator.dll, grandrp.dll, gta5rp.dll, lineage2.dll, majestic.dll, rmrp.dll, rusfish4.dll, setup.dll, trigger.dll — each with a unique but structurally identical SHA-256). Ten of the eleven downloaders spawn a hidden PowerShell process using the `runas` verb to start the Windows Time service and force a clock resync, which functions as a pretext for UAC elevation. All downloaders use a custom `SocketsHttpHandler` with a `ConnectCallback` that resolves GitHub hosts through `dns.google/resolve` (DNS-over-HTTPS), bypassing local hosts-file and DNS-sinkhole blocking. All 11 share an identical hardcoded AWS-style access key/secret key pair and an identical process-mutex GUID (`Global\{5BD61028-3D9C-4B4E-AD45-CA4F1B35D0F4}`, derived from the same key material) that prints the Russian message 'Программа уже запущена' ('The program is already running') on re-invocation — conclusive evidence of a single shared build pipeline and operator.
Second-stage payload retrieval is multi-tiered: primary distribution via a Hugging Face bucket mirror (`huggingface.co/buckets/pepegit666/<tag>/resolve/pepesoft.exe`), fallback to GitHub Releases on the staging repo `github.com/pepegit666/123f53y45ysdf34` (tags per game: albion.onlinepanel, amazing.rp, calculator, grandrp.su, gta5rp.com, lineage2panel, majesticpanel, rmrp, russianfish4, throne, trigpanel), and a dormant BitTorrent magnet-link branch (MonoTorrent/Mono.Nat libraries bundled but inert in analyzed samples). Runtime configuration is retrieved from a Cloudflare Worker (`calm-voice-9797.888c888x888.workers.dev`), with an S3-compatible fallback store (`s3.ru-3.storage.selcloud.ru`, bucket `zfile`).
The resulting second-stage payload, pepesoft.exe, is PyInstaller-packed; 8 of 11 variants (Amazing RP, GrandRP, GTA5RP, Lineage 2, Majestic, RMRP, Russian Fishing 4, Trigger) are additionally protected with PyArmor and, embedded Python source is base64+zlib compressed and Fernet-encrypted, decoded and `exec()`'d at runtime. The remaining 3 variants (Albion, Calculator/'gtaobus.pyc', Throne) ship as unprotected direct Python bytecode modules. On execution, pepesoft.exe authenticates to a set of Google Sheets used as a telemetry and licensing backend: shared sheets `info`, `GTA5RP` (ban-list), and `STAT` (direct-bytecode telemetry), plus per-game product sheets (RMRP, AMAZING, GRANDRP, GTA5RP, L2, MajesticMAIN, RusFish4, TriggerRP, ALBIONBOTMAIN, GTA5RPCALC, THRONE). It records hardware fingerprints (CPU, motherboard, GPU model), hostname, IP-based geolocation, and OS activation status, then re-reads the stored spreadsheet row on subsequent launches and compares it to the live machine to enforce hardware-bound licensing. It also checks the host's HWID/UUID against a 'banned' worksheet; a match halts execution with the message 'Ваш ПК в системе приостановлен' ('Your PC is suspended in the system'), giving the operator a remote kill-switch. The 8 PyArmor-protected variants probe direct Google Sheets/googleapis.com access first and, on failure, retry the same traffic through a hardcoded authenticated HTTP proxy (`196.16.3.71:9528`, credentials `X1U0z7:ZHcUHN`) to bypass IP-level blocking.
For interactive access, the 3 direct-bytecode variants run an `aio
Weaknesses (CWE)
CWE-506, CWE-494, CWE-522, CWE-798
Target sectors: gaming, individual consumers, software supply chain
Target regions: Global, russia, CIS / Russian-speaking gaming communities
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 39 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1584, T1587, T1583, T1195, T1199, T1204, T1059, T1059, T1547, T1112