Socket: 11 Malicious NuGet Tools Pose as Game Cheats

What it is

Eleven malicious NuGet DotnetTool packages published by the account pepegit666, masquerading as game cheats/bots/"panels" for Russian-language game communities (Albion Online, GTA5RP, GrandRP, Majestic RP, RMRP, Amazing RP, Lineage 2, Throne and Liberty, Russian Fishing 4, plus generic trigger-bot and calculator themes). Each is a first-stage .NET downloader that pulls a second-stage pepesoft.exe from GitHub Releases and Hugging Face. Socket has reported the packages and requested publisher suspension; treat this as a hunt/detection item, not a patch.

How it works

Packages install via dotnet tool install and register console commands (e.g. throne-run). The downloader assembly sits under tools/net8.0/any/ (albion.dll, gta5rp.dll, lineage2.dll, setup.dll for Throne). Concrete, hunt-able artifacts the page discloses:

• Single-instance mutex shared by all 11 packages: Global\{5BD61028-3D9C-4B4E-AD45-CA4F1B35D0F4}.
• Credential passing: the downloader sets three environment variables in its own process (two AWS-style keys plus an endpoint URL pointing at a Cloudflare Worker) so the child pepesoft.exe inherits them — keys are never embedded in the payload.
• Clock resync via UAC: 10 of 11 downloaders spawn hidden PowerShell with the runas verb running Start-Service w32time; w32tm /resync. The Calculator downloader lacks this routine.
• DoH evasion: hosts containing the string github are resolved through https://dns.google/resolve via a custom SocketsHttpHandler.ConnectCallback, bypassing the system resolver, hosts file, and DNS sinkholes.
• Colored Russian-language updater text via Colorful.Console; bundled MonoTorrent/Mono.Nat stacks provide dormant BitTorrent fallback.

Payloads are PyInstaller-packed. Three (Albion, Calculator, Throne) ship gtaobus.pyc as direct bytecode; the other eight wrap it with pyarmor_runtime_015050. Each of the eight PyArmor tags recovers to a distinct hash.

Preconditions / Affected

Windows developers or gamers who install .NET tools from NuGet. Requires the user to accept the UAC elevation prompt for the clock-resync step. Telegram screenshot-exfiltration commands are proven only in the three direct-bytecode payloads, not the full set.

What to do

The page gives no patch. Hunt for the mutex GUID above; alert on dotnet tool processes issuing w32tm /resync under runas, or resolving GitHub hosts via dns.google. Block/remove any DotnetTool from publisher pepegit666 and any process named pepesoft.exe. Flag outbound to a Cloudflare Worker endpoint carrying AWS-style keys and Google Sheets telemetry.

Caveats

The fetched text is truncated mid-sentence in the DoH section; the full IOC list (package hashes, exact endpoints, ban-list mechanics) lives on the source page. Telegram/screenshot capability and the ~1,040-line licensing module are attributed to specific payload subsets, not all 11.