MP

Matt Poto

Things Matt Says on Podcasts

Where to Find Them

Matt Poto has been a guest on CyberWire Daily .

Recently: “Stealing more than the spotlight. [Research Saturday]” on CyberWire Daily (November 2026).

What They Said

“Anything over 200 megabytes was written with just random data so that it would effectively destroy them. And then they put up a ransom note that just says your files have been encrypted and we don't want anything. Your files have been destroyed forever.” — Matt Poto, CyberWire Daily

Matt Poto walks through the ransomware hidden in a fake GTA 6 installer. It encrypts small files and overwrites large ones, so it acts as a wiper with no way to pay for recovery.

CyberWire Daily · 2026-11-07 Permalink → Listen →
CyberWire Daily Around 06:05 into the episode
Matt Poto

Yep, you got it.

Dave Bittner

Take us through that.

Matt Poto

Sure. So chaos is, again, another known ransomware variant. This one specifically, it would, you know, when you install it, it would find files that were smaller than 200 megabytes and it would create a password and it would encrypt them with that password, each file having its own unique password. Anything over 200 megabytes was written with just random data so that it would effectively destroy them. And then they put up a ransom note that just says your files have been encrypted and we don't want anything. Your files have been destroyed forever.

Dave Bittner

So no opportunity to pay some more money and get the files back.

Matt Poto

Yep. Yeah. This specific variant I found was just trying to inflict maximum damage, it seems.

Dave Bittner

Wow. Now, one of the interesting details is that the installer also drops the Yandex browser. Why do you suppose that was included as well?

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.
“Games these days are really, really large, often over 100 gigabytes. So you really want the victim to believe they're actually downloading Grand Theft Auto until the moment that they get you.” — Matt Poto, CyberWire Daily

Dave Bittner asked why fake GTA 6 download files were made over 100 gigabytes. Matt Poto, a researcher who analyzed the malware, explains that the huge size is deliberate camouflage, because real modern games are that big.

CyberWire Daily · 2026-11-07 Permalink → Listen →
CyberWire Daily Around 02:46 into the episode
Matt Poto

As far as I'm aware, they are all scams or malware.

Dave Bittner

Gotcha. Now, some of these ISO files were more than 100 gigabytes. Why go to the trouble of making a malicious download look that large?

Matt Poto

Well, games these days are really, really large, often over 100 gigabytes. So, you know, you really want the victim to believe they're actually downloading Grand Theft Auto until the moment that they get you.

Dave Bittner

Well, walk us through what happens when someone mounts one of these volumes and they run the installer.

Matt Poto

Yeah, so what I had found when I had found an example was the installer claimed it was GTA 6. It said it had, this one I specifically found had Russian language on it. And it said the GTA 6 installer, it's an unreleased game. And that if you receive an error that says license not found, to email…

Dave Bittner

Wow. Well, where to begin, right? Let's start with the remote access Trojans. What was installed and what are they capable of doing?

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

Collections They Appear In

Software Engineering & Infra