Threat video1:00
WARDEN Stealer Fake GTA 6 EXE Lure: Detection & IOCs
A fake GTA 6 EXE lure drops WARDEN Stealer that takes Steam logins and crypto wallets. Includes 9 detection rules (one free in Splunk SPL) and 22 IOCs.
Read the full threat intel for WARDEN Stealer Fake GTA 6 EXE Lure: Detection & IOCs →
Chapters
- 0:00The hookWarden: 130,000+ infections.
- 0:05The storyResearchers found a fake GTA 6 download.
- 0:11Attack pathReportedly, researchers reproduced the lure.
- 0:25AttributionNo threat actor: this was defensive research.
- 0:30Indicators of compromise19 indicators to hunt: 1 IP, 9 domains and 7 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques11 ATT&CK techniques, from execution to impact.
- 0:43Remediation5 steps now: Do not run any 'GTA 6' EXE/ZIP.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Warden: 130,000+ infections. Fake GTA 6.
0:06Researchers found a fake GTA 6 download.
0:09Inside was a stealer.
0:12Reportedly, researchers reproduced the lure.
0:15Its readme asks for admin rights and, if blocked, an exclusion.
0:19It takes saved passwords and wallets.
0:21Clipboard crypto addresses swapped.
0:26No threat actor: this was defensive research.
0:3019 indicators to hunt: 1 IP, 9 domains and 7 SHA-256 hashes, and more.
0:3911 ATT&CK techniques, from execution to impact.
0:445 steps now: Do not run any 'GTA 6' EXE/ZIP.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.