A cybercriminal group often called Uncommon Werewolf is operating a focused phishing marketing campaign towards Russian and CIS-based corporations, hijacking gadgets to mine crypto and steal delicate information.
Kaspersky’s analysis revealed that the APT group Uncommon Werewolf, also referred to as “Librarian Ghouls” and “Rezet,” has remained persistently lively by way of Could, finishing up a relentless marketing campaign that targets organizations throughout Russia and the CIS.
The group makes use of phishing emails disguised as communications from reputable organizations to deceive victims into opening malicious attachments. As soon as these information are executed, the attackers acquire distant entry to the machine, exfiltrate delicate information (comparable to credentials and crypto pockets information), after which deploy Monero (XMR) crypto miners to use the system’s processing energy.” To keep away from detection, they schedule the compromised machine to robotically get up at 1 AM and shut down at 5 AM, guaranteeing their actions go unnoticed.
Kaspersky studies that the group primarily targets industrial enterprises, with engineering faculties additionally being of explicit curiosity. The phishing emails are written in Russian and sometimes comprise attachments with Russian-language filenames and decoy paperwork, which means that the group’s main victims are based mostly in Russia or are Russian audio system.
Kaspersky’s investigation additionally uncovered a number of domains that could be linked to the Librarian Ghouls marketing campaign, though they’ve low confidence on this connection. Among the many domains nonetheless lively on the time have been users-mail[.]ru and deauthorization[.]on-line, each of which hosted phishing pages. These pages, created with PHP scripts, have been designed to steal login credentials for the favored Russian e-mail service Mail.ru.
As of the discharge of Kaspersky’s analysis, the Librarian Ghouls APT marketing campaign stays lively, with ongoing assaults noticed as not too long ago as final month.
