Loading threat actor…
Asha Hacker Team is the name used in the desktop-waller message of a destructive malware campaign distributed through fraudulent Grand Theft Auto VI downloads. The operation uses oversized, junk-padded ISO images promoted through search-engine poisoning, gaming forums, social media, and torrent sites, targeting prospective players with a Russian-language fake installer. The installer deploys NJRAT and DCRAT remote-access trojans, Mercurial Grabber, and a Chaos ransomware variant. The remote-access and infostealer components support remote system control, command execution, keylogging, webcam and desktop access, browser credential and cookie theft, theft of gaming-platform sessions and Discord tokens, cryptocurrency-related data theft, system discovery, screenshot capture, and data exfiltration. The Chaos payload functions primarily as a wiper: when executed with administrative privileges, it removes recovery mechanisms, encrypts smaller files, irreversibly overwrites larger files, and leaves a note without a viable payment mechanism. Russian-language lures and installation of Yandex Browser indicate that Russian-speaking users were likely a primary intended audience, but the group’s identity, origin, and any state affiliation are not established.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
2 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.