Hacker group Rare Werewolf hijacks Russian devices to mine crypto and steal data

by

Werewolves in the Cyber Woods: Crypto Mining and Data Theft, Oh My! 🐺💰

So, there’s this cybercriminal group called Rare Werewolf. Yes, you heard that right—Rare Werewolf. Sounds like a bad B-movie, right? Well, they’re not just howling at the moon; they’re running a phishing campaign that’s targeting Russian and CIS companies like a wolf on a mission to steal your grandma’s secret cookie recipe. 🍪

Kaspersky, the cyber sleuths of our time, have discovered that these “Librarian Ghouls” (seriously, who names these groups?) have been busy little bees through May, launching a relentless campaign that’s like a bad sequel to a horror movie—only this time, the victims are organizations across Russia and the CIS. 🎬

How do they do it? Well, they send out phishing emails that look as legit as a celebrity’s Instagram post. Victims open these malicious attachments, and boom! The attackers are in, stealing sensitive data like credentials and crypto wallet info faster than you can say “not my password!” And just to keep things spicy, they deploy Monero (XMR) miners to suck the life out of the device’s processing power. Oh, and they’ve got a schedule—waking up at 1 AM and shutting down at 5 AM. Because nothing says “I’m a professional criminal” like a good night’s sleep! 😴

Kaspersky also found some domains linked to these Librarian Ghouls, but they’re not too confident about it. Among the active domains were users-mail[.]ru and deauthorization[.]online, which hosted phishing pages designed to steal login credentials for Mail.ru. Because who doesn’t want to steal your neighbor’s email? 🙄

As of Kaspersky’s latest research, the Librarian Ghouls are still at it, with ongoing attacks observed as recently as last month. So, if you’re in Russia or just happen to be a Russian speaker, keep your eyes peeled and your passwords tighter than a pair of Spanx! 🔒

Read More

2025-06-11 14:02