The four OTX pulses converge on one enterprise risk: credential and identity material is being harvested at scale through user-trusted lures and internet-facing application flaws. The GTA6 pulse uses SEO poisoning, forums, social media and torrents to push malicious ISO images themed as leaked game builds; the payload bundle includes njRAT/Njw0rm/Bladabindi/LV, DCRAT, Mercurial Grabber and Chaos ransomware, indicating a blended objective of remote access, browser/credential theft and extortion. The fake CCleaner pulse shifts to software masquerading: a lookalike site drops GhostDesk, a Chrome-extension spyware/keylogger staged through CScript and browser configuration tampering. The PaperCut pulse shows exploitation of public-facing print management servers using CVE-2026-81578 and CVE-2026-82078, with evidence of AI-assisted target filtering, PoC iteration, reverse shells and SOCKS proxy conversion. The passkey pulse, attributed to Storm-3121 and Storm-3032, uses helpdesk vishing/SMS plus passkey-registration lures, AiTM phishing and device-code authentication to add unauthorized methods and persist in cloud tenants.
Collectively, the intrusion path is: lure or exploit -> script/LOLBins execution -> browser/session/token theft -> persistence through extensions, run keys, added auth methods or compromised services -> C2/proxy egress and cloud data access. The unifying target is identity: passwords, cookies, session tokens, recovery paths, MFA/passkey enrollment flows and cloud account control.
Threat Actor / Malware Profile
- njRAT / Njw0rm / Bladabindi / LV / DCRAT: commodity .NET RAT ecosystem spread through trojanized GTA6 ISOs. Typical behavior includes masquerading as game launchers or setup files, spawning scripted installers from mounted media, beaconing to dynamic DNS or low-reputation C2, keylogging, screen capture, credential collection and second-stage payload retrieval. Persistence is commonly registry Run keys, startup folders, scheduled tasks and injected or copied payloads under user-writable paths.
- Mercurial Grabber: browser/Discord/crypto-wallet oriented infostealer often bundled with crack/launcher bait. Prioritize artifacts in browser profile stores, Discord Local Storage, wallet extension paths and recent archive/ISO execution.
- Chaos ransomware: suggests follow-on extortion after access and theft. Treat any RAT or grabber detection on an endpoint as a potential pre-ransomware event.
- GhostDesk Chrome spyware: delivered by fake CCleaner sites such as ccleanerwind.top and infrastructure including liderongrade.duckdns.org. The chain abuses CScript/WScript and Chrome policy or preference manipulation to install a malicious extension, capture keystrokes, read browser data and maintain persistence through extension reload and browser launch.
- PaperCut exploitation: unknown operators used CVE-2026-81578 and CVE-2026-82078 against exposed PaperCut servers, then iterated with automation for research, target sourcing and execution. Expect web/service process spawning shells, encoded commands, reverse connections and SOCKS proxy tooling.
- Storm-3121 / Storm-3032 passkey-themed social engineering: phone/SMS pretexting impersonating IT helpdesk, AiTM pages mimicking Microsoft sign-in and device-code flows, followed by unauthorized passkey/security-info registration and cloud persistence. Key infrastructure includes setupmypasskey.com, validationsetupac.com, portalsetuphub.com, myconnectkey.com, oskeysync.com, keysyncos.com, oskeyregister.com and passkeyhelpdesk.com.
IOC Analysis
The set is weighted toward file hashes and phishing/C2 domains rather than high-confidence static IPs. Operationalize by class: block the eight passkey/AiTM domains and ccleanerwind.top at DNS, secure web gateway, email URL rewrite and browser isolation; sinkhole liderongrade.duckdns.org and alert on any DuckDNS resolution from endpoints or servers. Push the MD5 and SHA256 values into EDR block lists, threat-intel platforms, email detonation and retro-hunts, but prioritize behavior over hashes because ISOs and droppers are likely repacked. Add CVE-2026-81578 and CVE-2026-82078 to vulnerability management as exposure flags for PaperCut and any print-management adjacent service.
SOC tooling: EDR for hash and process ancestry, DNS/proxy for domain and dynamic-DNS analytics, Microsoft 365/Entra sign-in and audit logs for device-code and security-info changes, PaperCut server logs and EDR for service child processes, and sandbox detonation for ISO/MSI/EXE layers. Decode ISO chains by mounting in a controlled VM and extracting autorun, LNK, HTA, JS, BAT and embedded executable metadata; for Chrome spyware, diff Secure Preferences, Preferences and extension directories before and after execution.
Detection Engineering
---
title: Trojanized Game ISO Launches RAT or Infostealer Components
id: 8b3f2a21-9a10-4c2a-9f6d-ota6iso0001
status: experimental
description: Detects mounted ISO or user-downloaded media spawning script interpreters, rundll32, dotnet payloads or common RAT/infostealer process names consistent with fake GTA6 installer activity.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \explorer.exe
- \powershell.exe
- \wscript.exe
- \cscript.exe
- \msiexec.exe
- \rundll32.exe
ParentCommandLine|contains:
- .iso
- GTA
- launcher
- setup
- crack
selection_child:
Image|endswith:
- \cscript.exe
- \wscript.exe
- \powershell.exe
- \rundll32.exe
- \dotnet.exe
- \regsvr32.exe
- \schtasks.exe
- \chrome.exe
CommandLine|contains:
- Temp
- AppData
- ProgramData
- .js
- .jse
- .vbs
- .bat
- .ps1
- http://
- https://
condition: selection_parent and selection_child
falsepositives:
- Legitimate game launchers and enterprise software distribution
level: high
tags:
- attack.t1204
- attack.t1059
- attack.t1036
date: 2026/09/10
---
title: Chrome Browser Configuration or Extension Tampering by Script Interpreter
id: 7d1af4c7-ghostdesk-4e1a-9d0c-chrome0002
status: experimental
description: Detects CScript or WScript touching Chrome Secure Preferences, Preferences, Extensions or policy paths as reported in fake CCleaner GhostDesk spyware deployment.
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \cscript.exe
- \wscript.exe
- \powershell.exe
selection_path:
CommandLine|contains:
- Google\Chrome
- Secure Preferences
- \Extensions\
- Default\Preferences
- ExtensionInstallForcelist
- Chrome\User Data
condition: selection_img and selection_path
falsepositives:
- Enterprise browser management software
- Signed Chrome policy deployment tools
level: critical
tags:
- attack.t1176
- attack.t1112
- attack.t1554
date: 2026/09/10
---
title: PaperCut or Print Service Spawning Shell Proxy or Encoded Command
id: 5a9c77d1-papercut-4d6f-a1b2-print0003
status: experimental
description: Detects public-facing PaperCut or print services spawning cmd, powershell, curl, certutil, nc or SOCKS proxy tooling after CVE-2026-81578 or CVE-2026-82078 exploitation.
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- papercut
- pc-app
- pc-web
- print
- spoolsv.exe
- java.exe
- tomcat
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \curl.exe
- \certutil.exe
- \bitsadmin.exe
- \nc.exe
- \ncat.exe
- \plink.exe
- \ssh.exe
selection_cli:
CommandLine|contains:
- -enc
- -e
- FromBase64String
- IEX
- Invoke-Expression
- socks
- proxy
- reverse
- /c echo
- http://
- https://
condition: selection_parent and selection_child and selection_cli
falsepositives:
- Print server administration, vendor support scripts and patch activity
level: high
tags:
- attack.t1190
- attack.t1059
- attack.t1090
date: 2026/09/10
let AiTMDomains = dynamic(["setupmypasskey.com","validationsetupac.com","portalsetuphub.com","myconnectkey.com","oskeysync.com","keysyncos.com","oskeyregister.com","passkeyhelpdesk.com","ccleanerwind.top","liderongrade.duckdns.org"]);
let SuspectNames = dynamic(["njrat","dcrat","mercurial","ghostdesk","ccleaner","gta","launcher","setup"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where RemoteUrl has_any (AiTMDomains) or RemoteIPType has "Public"
| extend Hit = case(RemoteUrl has_any (AiTMDomains), "OTX domain", InitiatingProcessFileName has_any (SuspectNames), "Suspect process", "context")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Hit),
(DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where ProcessCommandLine has_any ("Secure Preferences","ExtensionInstallForcelist","Google\\Chrome","papercut","spoolsv","FromBase64String","socks","device code","passkey")
or FileName in~ ("cscript.exe","wscript.exe","powershell.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe","nc.exe","plink.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256),
(SigninLogs
| where TimeGenerated >= ago(14d)
| where AuthenticationProtocol has "deviceCode" or UserAgent has_any ("passkey","helpdesk","sync") or IPAddress in ()
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, AuthenticationProtocol, Status, RiskDetail)
$ErrorActionPreference = 'SilentlyContinue'
$domains = @('setupmypasskey.com','validationsetupac.com','portalsetuphub.com','myconnectkey.com','oskeysync.com','keysyncos.com','oskeyregister.com','passkeyhelpdesk.com','ccleanerwind.top','liderongrade.duckdns.org')
$hashes = @('c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23','8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904','3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf','08387ff35cc7854ddea1e2106b1150e9fe80646541c95c5a7121b77c9bc0228e')
Write-Host '[1] DNS cache and active connections for OTX domains'
Get-DnsClientCache | Where-Object { $d=$_.Entry; $domains | Where-Object { $d -like "*$_*" } } | Format-List
Get-NetTCPConnection | Where-Object { $_.RemotePort -in 80,443,8080 } | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess
[pscustomobject]@{Local=$_.LocalAddress; Remote=$_.RemoteAddress; Port=$_.RemotePort; Process=$p.ProcessName; Path=$p.Path}
} | Format-Table -AutoSize
Write-Host '[2] Chrome extension and preference tampering'
$chromeRoots = @("$env:LOCALAPPDATA\Google\Chrome\User Data", "$env:PROGRAMFILES\Google\Chrome\Application", "$env:PROGRAMFILES(X86)\Google\Chrome\Application")
foreach ($root in $chromeRoots) {
Get-ChildItem $root -Recurse -Include 'Secure Preferences','Preferences','manifest.json' -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
Select-Object FullName, LastWriteTime, Length
}
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist','HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist' | Format-List
Write-Host '[3] Persistence locations and recent script droppers'
$run = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
foreach ($k in $run) { Get-ItemProperty $k | Select-Object * | Format-List }
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' -and $_.Date -gt (Get-Date).AddDays(-14) } | Select-Object TaskName, TaskPath, Date, Author
Get-ChildItem "$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:PUBLIC\Downloads" -Recurse -Include *.js,*.jse,*.vbs,*.bat,*.ps1,*.exe,*.iso -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
Select-Object FullName, LastWriteTime, Length
Write-Host '[4] Hash retro-hunt on common staging paths'
Get-ChildItem "$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads" -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
$h = Get-FileHash $_.FullName -Algorithm SHA256
if ($hashes -contains $h.Hash) { [pscustomobject]@{Path=$_.FullName; SHA256=$h.Hash; LastWriteTime=$_.LastWriteTime} }
} | Format-List
Write-Host '[5] Entra passkey and device-code review should be run in cloud portal: security info changes, new passkeys, device code sign-ins, app consent and risky service principal activity.'
Response Priorities
- Immediate: block and sinkhole listed domains and dynamic DNS; add hashes to EDR/NGAV block lists; isolate endpoints with mounted GTA/CCleaner lures, unexpected Chrome extension changes, PaperCut service child shells or AiTM domain contact; capture memory and browser profile copies before cleanup.
- 24h: for any exposed user, revoke sessions and refresh tokens, remove newly added passkeys/security methods, reset credentials from a clean device, review Entra security-info changes and device-code sign-ins, force MFA re-registration, check mailbox rules, OAuth consent, VPN and cloud audit logs; treat RAT/grabber hits as possible pre-ransomware and validate backups.
- 1 week: restrict ISO mounting and script interpreters for standard users, enforce Chrome extension allowlisting and policy-protected preferences, patch or isolate PaperCut and remove public exposure, require phishing-resistant MFA with managed passkey enrollment workflows, alert on helpdesk-themed passkey reset lures, and add detections for service-to-shell, browser tamper and dynamic-DNS egress.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.