Loading threat actor…
CyberLeek, also styled Cyberleek, is an anonymous, financially motivated data-extortion persona associated with unauthorized disclosures of Rockstar Games’ Grand Theft Auto VI material in August 2026. Its campaign targeted intellectual property belonging to Rockstar Games and parent company Take-Two Interactive, publishing unreleased gameplay footage and map imagery in staged releases. The operator’s identity, organizational structure, and method of obtaining the material have not been publicly established. CyberLeek monetizes attention generated by leaked intellectual property rather than relying solely on a conventional ransom demand. It promoted a Solana-based memecoin, watermarked leaked footage with token branding, used token-holder voting to select subsequent disclosures, and offered advertising space on future leaks. It threatened to release a complete playable game build if the token reached a US$30 million market capitalization, although possession of such a build has not been independently established. The persona also framed its disclosures as a protest against digital preorders and restrictions on long-term access to single-player games, demanding a physical-disc release and a public apology. Its operational model combines publication of proprietary material, threats of additional disclosures, audience-building, and cryptocurrency promotion. Take-Two pursued copyright takedowns and subpoenas to identify accounts connected to the disclosures. Malware campaigns exploiting the leaks and impersonating CyberLeek have not been established as operations of the persona itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
CyberLeek is the named actor behind GTA 6 footage leaks and threats to publish a complete playable build. It seeks to increase the value of its cryptocurrency token rather than demand a direct ransom. It also demands a physical-disk release and a public apology as conditions for withdrawing its threats. The content does not establish whether CyberLeek possesses a complete playable build or whether it represents an individual or a group.
Cyberleek is leaking footage and story spoilers from an allegedly stolen, apparently complete GTA VI build. It threatens Take-Two Interactive and Rockstar Games with publication of the full game unless they commit to a physical release and apologize. However, its latest message also conditions publication on its memecoin reaching a $30 million market capitalization. The article portrays the operation as financially motivated cryptocurrency manipulation and reports that the leakers previously cashed out approximately $250,000. No malware use, intrusion method, or state sponsorship is identified.
Allegedly distributed unauthorized clips of unreleased Grand Theft Auto VI gameplay beginning around August 18. Take-Two's ongoing investigation and targeted Discord subpoenas seek to identify people connected to the leak, but no individual has been publicly charged or formally identified as responsible.
Financially motivated extortion group conducting theft of data and intellectual property, apparently using public attention around stolen material to increase potential revenue.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.