{
  "campaign": {
    "name": "Pepesoft",
    "slug": "pepesoft",
    "href": "/ti/campaigns/pepesoft",
    "description": "Commercial paid game-cheat operation run under the \"Pepesoft\" brand (operator username pepegit666, storefront bots.pepesoft[.]ru, Telegram t[.]me/pepesoft777). Eleven NuGet DotnetTool downloaders posing as game cheats/tools each fetch a shared PyInstaller second-stage (pepesoft.exe) that performs Windows host surveillance. Single toolchain: all 11 share the same AWS-style key material and process-mutex GUID. Uses Google Sheets for host telemetry/licensing, hardware-fingerprint binding, a server-side HWID/UUID ban-list kill switch, and (in 3 direct-bytecode builds) Telegram screenshot remote-control. Russian-speaking operator/audience (language, .su/.ru staging, Selectel S3, Russian RP game targets) recorded as a language/targeting signal, NOT a nationality or state-affiliation claim.",
    "objective": "Distribute a Windows host-surveillance payload as a paid game-cheat service with Sheets-based telemetry/licensing and a remote HWID kill switch.",
    "aliases": [
      "pepegit666"
    ],
    "discovered_at": "2026-07-14"
  },
  "packages": [
    {
      "ecosystem": "nuget",
      "name": "albion-x-x",
      "href": "/ti/packages/nuget/albion-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent",
        "rat"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "amazing-x-x",
      "href": "/ti/packages/nuget/amazing-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "7.7.8"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "calc-x-x",
      "href": "/ti/packages/nuget/calc-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent",
        "rat"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "grandrp-x-x",
      "href": "/ti/packages/nuget/grandrp-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "gta5rp-x-x",
      "href": "/ti/packages/nuget/gta5rp-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "l2-x-x",
      "href": "/ti/packages/nuget/l2-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "majestic-x-x",
      "href": "/ti/packages/nuget/majestic-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "rmrp-x-x",
      "href": "/ti/packages/nuget/rmrp-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "rusfish4-x-x",
      "href": "/ti/packages/nuget/rusfish4-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "throne-x-x",
      "href": "/ti/packages/nuget/throne-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent",
        "rat"
      ],
      "versions": [
        "unspecified"
      ]
    },
    {
      "ecosystem": "nuget",
      "name": "trigger-x-x",
      "href": "/ti/packages/nuget/trigger-x-x",
      "threat_types": [
        "data_exfiltration",
        "c2_agent"
      ],
      "versions": [
        "unspecified"
      ]
    }
  ],
  "indicators": [
    {
      "kind": "github_repo",
      "value": "github.com/pepegit666/123f53y45ysdf34",
      "href": "/ti/ioc/github_repo/github_repo-f955b0204793",
      "context": "Operator pepegit666 GitHub repo used to stage the pepesoft.exe payload on GitHub Releases."
    },
    {
      "kind": "domain",
      "value": "calm-voice-9797.888c888x888.workers.dev",
      "href": "/ti/ioc/domain/calm-voice-9797.888c888x888.workers.dev",
      "context": "Cloudflare Worker URL passed to the payload as AWS_CONFIG_KEY; serves service.json (Google service-account creds + S3 config)."
    },
    {
      "kind": "domain",
      "value": "s3.ru-3.storage.selcloud.ru",
      "href": "/ti/ioc/domain/s3.ru-3.storage.selcloud.ru",
      "context": "Selectel S3-compatible object storage (bucket \"zfile\") used as service.json fallback and full read/write client via aiobotocore."
    },
    {
      "kind": "domain",
      "value": "bots.pepesoft.ru",
      "href": "/ti/ioc/domain/bots.pepesoft.ru",
      "context": "Operator paid-cheat storefront (Pepesoft brand)."
    },
    {
      "kind": "domain",
      "value": "dns.google",
      "href": "/ti/ioc/domain/dns.google",
      "context": "LEGITIMATE Google DNS-over-HTTPS resolver (dns.google/resolve) abused to resolve any host containing \"github\" and connect to the returned IP directly, bypassing hosts-file/local DNS sinkholes. Legit service, low IOC value."
    },
    {
      "kind": "url",
      "value": "https://github.com/pepegit666/123f53y45ysdf34/releases/download/<tag>/pepesoft.exe",
      "href": "/ti/ioc/url/url-f1fbae80bd88",
      "context": "GitHub Releases payload staging URL (per-game <tag>). Second fallback in the staging chain."
    },
    {
      "kind": "url",
      "value": "https://huggingface.co/buckets/pepegit666/<tag>/resolve/pepesoft.exe?download=true",
      "href": "/ti/ioc/url/url-da1ab19f1230",
      "context": "Hugging Face payload staging URL (per-game <tag>). First choice in the staging chain."
    },
    {
      "kind": "ipv4",
      "value": "196.16.3.71",
      "href": "/ti/ioc/ipv4/196.16.3.71",
      "context": "Authenticated HTTP proxy (port 9528, user X1U0z7 / pass ZHcUHN) used by the 8 PyArmor payloads to reroute Google Sheets traffic when direct access fails."
    },
    {
      "kind": "telegram_bot",
      "value": "t.me/pepesoft777",
      "href": "/ti/ioc/telegram_bot/t.me/pepesoft777",
      "context": "Operator Telegram channel (Pepesoft brand)."
    },
    {
      "kind": "discord_webhook",
      "value": "discord.com/api/webhooks/1156474517871403078/zuHl6xQzdMcFjNrmm9jTiHvCzNbCiQhkYAIGWNUfj7X4KUIpEATekKlSNna6OvyCKaRw",
      "href": "/ti/ioc/discord_webhook/discord_webhook-f5adb62dee12",
      "context": "Discord webhook constant present in direct-bytecode apps. CAVEAT: writeup did NOT confirm an active send path."
    },
    {
      "kind": "discord_webhook",
      "value": "discord.com/api/webhooks/1156474527874818088/qS5cJuxEbyIA1s3tZX_A2u6YsKtLUARVPvN77_6fK5QHGdGFHb3JSuCUSDhtouEsyJgk",
      "href": "/ti/ioc/discord_webhook/discord_webhook-56df74e06f53",
      "context": "Discord webhook constant present in direct-bytecode apps. CAVEAT: writeup did NOT confirm an active send path."
    },
    {
      "kind": "file_path",
      "value": "./libgg/chat_ids.txt",
      "href": "/ti/ioc/file_path/file_path-20c24c9c7759",
      "context": "Stores Telegram chat IDs after /start in direct-bytecode aiogram RAT builds."
    },
    {
      "kind": "file_path",
      "value": "%LOCALAPPDATA%\\Windows Src\\key*.txt",
      "href": "/ti/ioc/file_path/file_path-1459c5d7f08c",
      "context": "Activation-key storage used by pepesoft.exe."
    },
    {
      "kind": "file_path",
      "value": "./token.txt",
      "href": "/ti/ioc/file_path/file_path-bf16d25ecaa6",
      "context": "Payload artifact."
    },
    {
      "kind": "file_path",
      "value": "credentials.txt",
      "href": "/ti/ioc/file_path/file_path-4e1b775ea971",
      "context": "Payload artifact."
    },
    {
      "kind": "file_path",
      "value": "%APPDATA%\\pepesoft",
      "href": "/ti/ioc/file_path/file_path-5855e72fa99c",
      "context": "Payload working/state directory (Pepesoft brand)."
    },
    {
      "kind": "file_path",
      "value": "pepesoft.exe",
      "href": "/ti/ioc/file_path/file_path-827e8c2c445f",
      "context": "Shared PyInstaller (Python 3.13) second-stage host-surveillance payload dropped by all 11 downloaders."
    },
    {
      "kind": "sha256",
      "value": "d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609",
      "href": "/ti/ioc/sha256/d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609",
      "context": "SHA-256 of albion.dll first-stage NuGet downloader assembly (albion-x-x)."
    },
    {
      "kind": "sha256",
      "value": "567952daf0ab7b36b017aac9963791188dea0fbf2e99c7cc6f6652ee540f4840",
      "href": "/ti/ioc/sha256/567952daf0ab7b36b017aac9963791188dea0fbf2e99c7cc6f6652ee540f4840",
      "context": "SHA-256 of gtaobus.pyc entry module (direct bytecode) inside pepesoft.exe for Albion Online."
    },
    {
      "kind": "sha256",
      "value": "9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b",
      "href": "/ti/ioc/sha256/9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b",
      "context": "SHA-256 of amazingrp.dll first-stage NuGet downloader assembly (amazing-x-x)."
    },
    {
      "kind": "sha256",
      "value": "774e40046f353e3f916f39e3d13d6499da35705a479cfb89288c21017aaf5461",
      "href": "/ti/ioc/sha256/774e40046f353e3f916f39e3d13d6499da35705a479cfb89288c21017aaf5461",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Amazing RP."
    },
    {
      "kind": "sha256",
      "value": "e8c2618565aa31d7ffe909ebc99040bafcc0ea8df7f5d92fa673bb7ffacb14c9",
      "href": "/ti/ioc/sha256/e8c2618565aa31d7ffe909ebc99040bafcc0ea8df7f5d92fa673bb7ffacb14c9",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for Amazing RP."
    },
    {
      "kind": "sha256",
      "value": "900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e",
      "href": "/ti/ioc/sha256/900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e",
      "context": "SHA-256 of calculator.dll first-stage NuGet downloader assembly (calc-x-x)."
    },
    {
      "kind": "sha256",
      "value": "cc853b3e4504c890d275ac2327f18acd7e4c5b99ca056181f3f5694781f2cf45",
      "href": "/ti/ioc/sha256/cc853b3e4504c890d275ac2327f18acd7e4c5b99ca056181f3f5694781f2cf45",
      "context": "SHA-256 of gtaobus.pyc entry module (direct bytecode) inside pepesoft.exe for Calculator (GTA5RP calc)."
    },
    {
      "kind": "sha256",
      "value": "ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1",
      "href": "/ti/ioc/sha256/ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1",
      "context": "SHA-256 of grandrp.dll first-stage NuGet downloader assembly (grandrp-x-x)."
    },
    {
      "kind": "sha256",
      "value": "23e4d8af5425dae022793450190c8d30809b2986dd879eb4bff557cdacf49c86",
      "href": "/ti/ioc/sha256/23e4d8af5425dae022793450190c8d30809b2986dd879eb4bff557cdacf49c86",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for GrandRP."
    },
    {
      "kind": "sha256",
      "value": "6eefe9d5f030d403c72bd4e4caf5bbb9dbc2bd5e15ebb07de153494f458e5eb9",
      "href": "/ti/ioc/sha256/6eefe9d5f030d403c72bd4e4caf5bbb9dbc2bd5e15ebb07de153494f458e5eb9",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for GrandRP."
    },
    {
      "kind": "sha256",
      "value": "e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0",
      "href": "/ti/ioc/sha256/e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0",
      "context": "SHA-256 of gta5rp.dll first-stage NuGet downloader assembly (gta5rp-x-x)."
    },
    {
      "kind": "sha256",
      "value": "95577498d23fe750221a5badfc25b5e9f020dcf4d80c79a019b090e3c3b0a32a",
      "href": "/ti/ioc/sha256/95577498d23fe750221a5badfc25b5e9f020dcf4d80c79a019b090e3c3b0a32a",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for GTA5RP."
    },
    {
      "kind": "sha256",
      "value": "8ab256dd839aec6638cd46374f4a6664e534b9341bbcdfd9b763e5a27c51ddb7",
      "href": "/ti/ioc/sha256/8ab256dd839aec6638cd46374f4a6664e534b9341bbcdfd9b763e5a27c51ddb7",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for GTA5RP."
    },
    {
      "kind": "sha256",
      "value": "d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1",
      "href": "/ti/ioc/sha256/d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1",
      "context": "SHA-256 of lineage2.dll first-stage NuGet downloader assembly (l2-x-x)."
    },
    {
      "kind": "sha256",
      "value": "2a4fed04d792b9c2fdf9c1456a08ca23eda5fef50c0b409ab294ad489e12d801",
      "href": "/ti/ioc/sha256/2a4fed04d792b9c2fdf9c1456a08ca23eda5fef50c0b409ab294ad489e12d801",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Lineage 2."
    },
    {
      "kind": "sha256",
      "value": "6c1f828e4d8395dde8293868c65ba8d86b3b9672ebbbb16e932624706d37d832",
      "href": "/ti/ioc/sha256/6c1f828e4d8395dde8293868c65ba8d86b3b9672ebbbb16e932624706d37d832",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for Lineage 2."
    },
    {
      "kind": "sha256",
      "value": "4d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305",
      "href": "/ti/ioc/sha256/4d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305",
      "context": "SHA-256 of majestic.dll first-stage NuGet downloader assembly (majestic-x-x)."
    },
    {
      "kind": "sha256",
      "value": "7e42d25e707d29d5d185a4c5dc71019f744e88a30b66bbf06949194ff32dbc48",
      "href": "/ti/ioc/sha256/7e42d25e707d29d5d185a4c5dc71019f744e88a30b66bbf06949194ff32dbc48",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Majestic RP."
    },
    {
      "kind": "sha256",
      "value": "6cbd4bc491deb11040e2b2f91b0b4e129af551a802fc78cb42e0e985297ef44c",
      "href": "/ti/ioc/sha256/6cbd4bc491deb11040e2b2f91b0b4e129af551a802fc78cb42e0e985297ef44c",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for Majestic RP."
    },
    {
      "kind": "sha256",
      "value": "011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972",
      "href": "/ti/ioc/sha256/011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972",
      "context": "SHA-256 of rmrp.dll first-stage NuGet downloader assembly (rmrp-x-x)."
    },
    {
      "kind": "sha256",
      "value": "d59e1914d76499fa51bf861f418c84bda0b48913dc39bd2e73756e326e4ccbb0",
      "href": "/ti/ioc/sha256/d59e1914d76499fa51bf861f418c84bda0b48913dc39bd2e73756e326e4ccbb0",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for RMRP."
    },
    {
      "kind": "sha256",
      "value": "5d9843126db4223dc2a8a9cd4a627286fe1a6345e33b28e9c98b5fe56fe89da6",
      "href": "/ti/ioc/sha256/5d9843126db4223dc2a8a9cd4a627286fe1a6345e33b28e9c98b5fe56fe89da6",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for RMRP."
    },
    {
      "kind": "sha256",
      "value": "79c09e1ffb4804c14ff27d41ec08d4390455c92d65717be0aeeec2697297d76a",
      "href": "/ti/ioc/sha256/79c09e1ffb4804c14ff27d41ec08d4390455c92d65717be0aeeec2697297d76a",
      "context": "SHA-256 of rusfish4.dll first-stage NuGet downloader assembly (rusfish4-x-x)."
    },
    {
      "kind": "sha256",
      "value": "17b1d836c2f15a97be0350879943b04e14bc076cf09e31df0d73258ee10f7e7c",
      "href": "/ti/ioc/sha256/17b1d836c2f15a97be0350879943b04e14bc076cf09e31df0d73258ee10f7e7c",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Russian Fishing 4."
    },
    {
      "kind": "sha256",
      "value": "c9f3e7766dbe728d84a1243447faa5f5eba0645bf13089074d128ea7663e7f5b",
      "href": "/ti/ioc/sha256/c9f3e7766dbe728d84a1243447faa5f5eba0645bf13089074d128ea7663e7f5b",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for Russian Fishing 4."
    },
    {
      "kind": "sha256",
      "value": "5f3a9ebf7039097b3cdbca8609b5b68af07eeb1dbf716ba2817a97fc7c543854",
      "href": "/ti/ioc/sha256/5f3a9ebf7039097b3cdbca8609b5b68af07eeb1dbf716ba2817a97fc7c543854",
      "context": "SHA-256 of setup.dll first-stage NuGet downloader assembly (throne-x-x)."
    },
    {
      "kind": "sha256",
      "value": "476c6f36a22156e53548a87291989a21d6c905dcbd9e1bf68ff5bc12e5c8bb07",
      "href": "/ti/ioc/sha256/476c6f36a22156e53548a87291989a21d6c905dcbd9e1bf68ff5bc12e5c8bb07",
      "context": "SHA-256 of gtaobus.pyc entry module (direct bytecode) inside pepesoft.exe for Throne and Liberty."
    },
    {
      "kind": "sha256",
      "value": "23808e7638f7a00b1ef9b9f4ca524f8a46cf63be6f6b79fec8e4a3fd1cc82a1e",
      "href": "/ti/ioc/sha256/23808e7638f7a00b1ef9b9f4ca524f8a46cf63be6f6b79fec8e4a3fd1cc82a1e",
      "context": "SHA-256 of trigger.dll first-stage NuGet downloader assembly (trigger-x-x)."
    },
    {
      "kind": "sha256",
      "value": "01d2afea0f2201a3b59765a1a60ba324ff4b8fdd25f23a0e05824b97f195b27c",
      "href": "/ti/ioc/sha256/01d2afea0f2201a3b59765a1a60ba324ff4b8fdd25f23a0e05824b97f195b27c",
      "context": "SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for generic trigger-bot."
    },
    {
      "kind": "sha256",
      "value": "a2a5e473dba85959b21b7e8a184bc255d5f2dacdf7411b91d212fb1217d2518b",
      "href": "/ti/ioc/sha256/a2a5e473dba85959b21b7e8a184bc255d5f2dacdf7411b91d212fb1217d2518b",
      "context": "SHA-256 of second-stage pepesoft.exe PyInstaller payload for generic trigger-bot."
    }
  ],
  "ttps": [
    {
      "name": "Compromise Software Supply Chain",
      "mitre_attack_id": "T1195.002",
      "href": "/ti/ttps/T1195.002"
    },
    {
      "name": "Stage Capabilities: Upload Malware",
      "mitre_attack_id": "T1608.001",
      "href": "/ti/ttps/T1608.001"
    },
    {
      "name": "Ingress Tool Transfer",
      "mitre_attack_id": "T1105",
      "href": "/ti/ttps/T1105"
    },
    {
      "name": "Deobfuscate/Decode Files or Information",
      "mitre_attack_id": "T1140",
      "href": "/ti/ttps/T1140"
    },
    {
      "name": "Obfuscated Files or Information: Software Packing",
      "mitre_attack_id": "T1027.002",
      "href": "/ti/ttps/T1027.002"
    },
    {
      "name": "Application Layer Protocol: Web Protocols",
      "mitre_attack_id": "T1071.001",
      "href": "/ti/ttps/T1071.001"
    },
    {
      "name": "Command and Scripting Interpreter: PowerShell",
      "mitre_attack_id": "T1059.001",
      "href": "/ti/ttps/T1059.001"
    },
    {
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "mitre_attack_id": "T1059.003",
      "href": "/ti/ttps/T1059.003"
    },
    {
      "name": "Screen Capture",
      "mitre_attack_id": "T1113",
      "href": "/ti/ttps/T1113"
    },
    {
      "name": "System Information Discovery",
      "mitre_attack_id": "T1082",
      "href": "/ti/ttps/T1082"
    },
    {
      "name": "Process Discovery",
      "mitre_attack_id": "T1057",
      "href": "/ti/ttps/T1057"
    },
    {
      "name": "System Network Configuration Discovery",
      "mitre_attack_id": "T1016",
      "href": "/ti/ttps/T1016"
    },
    {
      "name": "Exfiltration Over Web Service",
      "mitre_attack_id": "T1567",
      "href": "/ti/ttps/T1567"
    },
    {
      "name": "Proxy: External Proxy",
      "mitre_attack_id": "T1090.002",
      "href": "/ti/ttps/T1090.002"
    },
    {
      "name": "Modify Registry",
      "mitre_attack_id": "T1112",
      "href": "/ti/ttps/T1112"
    },
    {
      "name": "File Deletion",
      "mitre_attack_id": "T1070.004",
      "href": "/ti/ttps/T1070.004"
    }
  ],
  "related_campaigns": [],
  "reports": [
    {
      "title": "11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload",
      "url": "https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats",
      "published_at": "2026-07-14"
    }
  ]
}