The source code of GTA5, the best-selling game of all time, was leaked on Christmas Eve, with the publisher claiming that the move was to avenge Arion Kurtaj, a member of the Lapsus$ hacking group who was recently sentenced to permanent medical surveillance, and to stop the malicious version of GTA5's source code from circulating online.
According to GTA Focal, the source code for GTA 5 was leaked on Christmas Eve, and the package is about 4GB in size and contains a large number of RAGE engine files, concepts and reference images, as well as an early map of GTA 5's San Andreas. The link to the game's source code was distributed by hackers to multiple channels, including Discord, a dark web site, and a Telegram channel.
The breach comes a year after the Lapsus$ threat actor hacked into Rockstar Games and stole the company's data.
In the Grand Theft Auto leak channel on Telegram, the channel owner named "Phil" posted a link to the source code and shared a screenshot of one of the folders.
Phil also paid tribute to Lapsus$ hacker Arion Kurtaj, who leaked the pre-release video of Grand Theft Auto 6 under the name "teapotuberhacker".
In 2022, Rockstar Games was hit by the infamous Lapsus$ hacking group, who compromised the company's Slack servers and Confluence wiki.
The hackers claimed at the time to have stolen the source code of GTA 5 and GTA 6 as well as the beta version of GTA 6 and shared samples of GTA 5 source code on forums and Telegram to prove that they had stolen the data.
Someone from the security research group vx-underground spoke with the leaker on Discord, who said that the source code was leaked sooner than expected. They claim to have received the source code in August 2023, and the motive for the leak is to crack down on scams in the GTA V mod community, with many people allegedly being scammed by people who claim to own the source code for GTA V.
While the leaked source code appears to be legitimate GTA 5 source code, its authenticity has not been verified. So far, Rockstar has not responded.
Lapsus$ hackers are good at social worker attacks & SIM swapping attacks
The hacker group Lapsus$ is made up of a group of teenage hackers (one of the main culprits sentenced to life surveillance was only 17 years old at the time of the crime), but they have displayed an astonishing attack force that is not proportionate to their age, and has terrified the world's top tech companies.
The Lapsus$ hacking group has long been adept at using social engineering and SIM swapping attacks to compromise corporate networks. The group has launched attacks on high-profile companies including Nvidia, Microsoft, Uber, Microsoft, Rockstar Games, Okta, Mercado Libre, T-Mobile, Ubisoft, Vodafone, and Samsung, among others. As part of the attack, the hackers also extort ransom payments from the companies with the stolen source code and customer data.
The U.S. Department of Homeland Security's (DHS) Cybersecurity Review Board analyzed its tactics and shared recommendations for preventing such attacks.
While the Lapsus$ group is no longer as active as it used to be after the arrest of its members, according to the latest news, individual members of the group have recently started making small moves in a loose hacking group called Scattered Spider.
The Scattered Spider group employs a similar tactic to Lapsus$, primarily by exploiting social engineering, phishing, MFA fatigue, and SIM swap attacks to gain initial network access to large organizations.