K2F RAT via NIKKE Launcher Supply-Chain Compromise + GTA VI & Bank Phishing Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack

---
title: K2F RAT C2 Communication - insightjs Infrastructure
id: 8f3a2c1e-9b4d-4e7a-a1c2-5d6e7f8a9b0c
status: experimental
description: Detects network connections to known K2F remote access agent C2 infrastructure identified in the NIKKE PC launcher CDN supply-chain compromise
references:
    - https://piyolog.hatenadiary.jp/entry/2026/11/05/133509
author: Security Arsenal Threat Intelligence
date: 2026/11/06
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection_domain:
        DestinationHostname:
            - 'analytics.insightjs.com'
            - '*.insightjs.org'
    selection_ip:
        DestinationIp:
            - '89.126.250.172'
            - '89.127.233.127'
    condition: selection_domain or selection_ip
falsepositives:
    - None expected; infrastructure is attacker-controlled
level: critical
---
title: Game Launcher Spawning Suspicious Script or Shell Child Process
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects game launcher processes (NIKKE and similar) spawning script interpreters, shells, or credential-access tooling - consistent with K2F delivery via tampered LuaJIT CDN scripts
references:
    - https://piyolog.hatenadiary.jp/entry/2026/11/05/133509
author: Security Arsenal Threat Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1059
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\nikke'
            - '\launcher'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\curl.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare legitimate launcher self-update activity; baseline per title
level: high
---
title: Credential Store Access by Non-Browser Process
id: 9d8c7b6a-5f4e-3d2c-1b0a-9e8d7c6b5a4f
status: experimental
description: Detects processes other than the browser itself accessing browser credential stores, crypto wallet files, or cloud CLI credential files - behavior consistent with K2F infostealer collection
author: Security Arsenal Threat Intelligence
date: 2026/11/06
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1552.001
logsource:
    category: file_access
    product: windows
detection:
    selection_target:
        TargetObject|contains:
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Microsoft\Edge\User Data\Default\Login Data'
            - '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
            - '\Exodus\exodus.wallet'
            - '\Electrum\wallets'
            - '\.aws\credentials'
            - '\.azure\'
            - '\.config\gcloud\'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\firefox.exe'
    condition: selection_target and not filter_browser
falsepositives:
    - Backup agents and DLP tooling; allowlist known enterprise software
level: high

// K2F C2 + GTA VI / Bank Phishing Infrastructure Hunt - Microsoft Sentinel
let c2_ips = dynamic(["89.126.250.172", "89.127.233.127"]);
let c2_domains = dynamic(["analytics.insightjs.com", "insightjs.org"]);
let phish_domains = dynamic(["gta6cyberleek.com", "cyberleek.click", "mygta6.icu", "gta6keycodes.com", "cyberleek.my", "contact-rockstargames.com", "cyberleek.cfd", "cyberleek.world", "53primaryset.com", "authorize-valley.com", "commercial-atfirst.com", "protect-pinnaclefp.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(45d)
    | where RemoteIP in (c2_ips) or RemoteUrl has_any (c2_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, IndicatorType="K2F_C2_Network"),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (phish_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, IndicatorType="Phishing_Domain"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(45d)
    | where InitiatingProcessFileName has_any ("nikke", "launcher")
    | where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "curl.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, IndicatorType="Launcher_Child_Process"),
    (CloudAppEvents
    | where TimeGenerated > ago(30d)
    | where Application == "Amazon Web Services"
    | where ActionType in ("GetCallerIdentity", "ListFoundationModels", "InvokeModel")
    | project TimeGenerated, AccountDisplayName, IPAddress, ActionType, IndicatorType="AWS_Key_Validation")
| sort by TimeGenerated desc

# K2F RAT + Credential Harvester IOC Hunt - Run elevated on suspect endpoints
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. K2F file hashes
$k2fHashes = @(
    '2f2aac505f486067af6831d6c75ea74df63acb1ed4e4002709c5962c68bd9203',
    '3aaafbd612f04501a6fdb0bb8b2f8a87796223e5584ac18ea5eb180feeafb193',
    '923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608',
    'c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc'
)
$searchPaths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:TEMP", "$env:ProgramData", "$env:USERPROFILE\Downloads")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -File -Depth 3 | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($k2fHashes -contains $h) {
            $report += [pscustomobject]@{Finding='K2F_HASH_MATCH'; Path=$_.FullName; Detail=$h}
        }
    }
}

# 2. Active connections to K2F C2
$c2 = @('89.126.250.172','89.127.233.127')
Get-NetTCPConnection | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [pscustomobject]@{Finding='C2_CONNECTION'; Path=$proc.Path; Detail="$($_.RemoteAddress):$($_.RemotePort) [$($proc.Name)]"}
}

# 3. DNS cache check for C2 / phishing domains
Get-DnsClientCache | Where-Object { $_.Entry -match 'insightjs|cyberleek|gta6|53primaryset|authorize-valley|commercial-atfirst|protect-pinnaclefp' } | ForEach-Object {
    $report += [pscustomobject]@{Finding='DNS_CACHE_HIT'; Path='DNSCache'; Detail=$_.Entry}
}

# 4. Persistence artifacts created during compromise window (2026-09-27 to 2026-11-04)
$winStart = Get-Date '2026-09-27'; $winEnd = Get-Date '2026-11-05'
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
            $report += [pscustomobject]@{Finding='RUN_KEY'; Path=$rk; Detail="$($_.Name) = $($_.Value)"}
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Date -ge $winStart -and $_.Date -le $winEnd } | ForEach-Object {
    $report += [pscustomobject]@{Finding='SCHED_TASK_WINDOW'; Path=$_.TaskPath; Detail="$($_.TaskName) created $($_.Date)"}
}

# 5. NIKKE launcher presence check
$launcher = Get-ChildItem -Path "$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:LOCALAPPDATA\Programs" -Recurse -Filter '*.exe' -Depth 3 | Where-Object { $_.Name -match 'nikke|launcher' }
foreach ($l in $launcher) {
    $report += [pscustomobject]@{Finding='LAUNCHER_PRESENT'; Path=$l.FullName; Detail=$l.LastWriteTime}
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\k2f_hunt_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($report.Count) findings exported." -ForegroundColor Green