Loading threat actor…
Cyberleek is an unidentified individual or group active in August 2026 that published purported unreleased Grand Theft Auto VI gameplay footage, screenshots, and map material associated with Rockstar Games and Take-Two Interactive. The persona combined staged releases of alleged proprietary game material with anti-consumer messaging concerning digital distribution, while also promoting a Solana-based token, token-holder voting on future releases, and paid advertising opportunities. The operation has been characterized as a financially motivated, publicity-driven data-extortion model: it used stolen or confidential intellectual property to attract an audience, threaten further disclosures, and generate cryptocurrency-related revenue rather than publicly demanding a conventional private ransom from the victim. Take-Two pursued DMCA subpoenas and takedowns to identify accounts associated with the dissemination. Cyberleek's identity, geographic origin, and the means by which it obtained the material remain unconfirmed. Unaffiliated criminals also used GTA VI and Cyberleek-themed lures to distribute malware; those campaigns should not be attributed to Cyberleek absent further evidence.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Allegedly distributed unauthorized clips of unreleased Grand Theft Auto VI gameplay beginning around August 18. Take-Two's ongoing investigation and targeted Discord subpoenas seek to identify people connected to the leak, but no individual has been publicly charged or formally identified as responsible.
Financially motivated extortion group conducting theft of data and intellectual property, apparently using public attention around stolen material to increase potential revenue.
An unidentified GTA VI leaker persona that appears to have used stolen gameplay releases to drive trading volume in the $CYBERLEEK Solana memecoin, collecting liquidity-provider fees and subsequently cashing out an estimated $250,000. The actor claimed to possess a full working build of the game.
An unidentified GTA VI leak actor/campaign that gradually releases allegedly authentic leaked material through Discord token polls while monetizing attention through the $CYBERLEEK Solana token. The article distinguishes this leak activity from the separate, opportunistic malware campaigns using fake playable Cyberleek GTA VI builds.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.