Research Saturday

This week, we are joined by Matt Poto, Associate Triage Analyst at Huntress, discussing their work on "Grand Theft Auto VI Hype Leads to Malware." Threat actors are exploiting the hype surrounding the upcoming release of Grand Theft Auto VI (GTA6) by distributing fake leaked game downloads designed to infect unsuspecting gamers. Huntress identified malicious ISOs promoted through search engine poisoning, gaming forums, torrent sites, and social media that contain multiple types of malware, including remote access trojans (RATs), an infostealer, and ransomware. The malware can steal credentials and personal information, give attackers control of compromised systems, and encrypt or destroy files, with evidence suggesting the campaign may be targeting Russian-speaking gamers. The research and executive brief can be found here: ⁠⁠⁠⁠⁠⁠⁠Grand Theft Auto VI Hype Leads to Malware Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we are joined by ⁠Subhajeet Singha⁠, Senior Security Researcher at ⁠Acronis⁠ Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data. The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise. The research and executive brief can be found here: ⁠⁠⁠⁠Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit⁠ Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we have Damon Rouse, Threat Intelligence from Lumen's Black Lotus Labs, discussing their work on "The infrastructure quartermaster: inside a China-nexus state enablement model." Black Lotus Labs identified a China-nexus cyber infrastructure provider, dubbed a “quartermaster,” that supplies reconnaissance, proxy routing, and obfuscation services to Chinese cyber espionage actors. Its interconnected systems, including QScan and Fast Labyrinth, help identify high-value targets, conceal malicious traffic, and support potential exploitation of government, military, research, and critical infrastructure networks. Researchers warn that this shared infrastructure makes traditional IP-based defenses less effective and recommend following CISA and NCSC guidance, reducing external attack surfaces, and keeping routers, firewalls, and IoT devices updated. The research and executive brief can be found here: The infrastructure quartermaster: inside a China-nexus state enablement model Learn more about your ad choices. Visit megaphone.fm/adchoices

Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project. The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure. The research and executive brief can be found here: ⁠A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise Learn more about your ad choices. Visit megaphone.fm/adchoices

Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, is discussing their work on "PhantomRaven, An LLM-Generated Information Stealer Developed for Bug Bounty Hunting." PhantomRaven, a JavaScript-based information stealer distributed through malicious npm packages by a financially motivated threat actor posing as a bug bounty hunter. The malware targets system information and continuous integration and continuous deployment (CI/CD) environment variables, likely seeking credentials, with analysis suggesting its code was generated using a large language model. The report explores how AI-generated tools may lower the barrier to cybercrime and outlines steps organizations can take to mitigate risks, including restricting package installation scripts, using private npm registries, and monitoring dependencies. The research and executive brief can be found here: PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting Learn more about your ad choices. Visit megaphone.fm/adchoices