According to Cointelegraph, the hacker group known as Librarian Ghouls, also referred to as Rare Werewolf, has compromised hundreds of Russian devices to mine cryptocurrency in a cryptojacking scheme. Cybersecurity firm Kaspersky reports that the group gains access to systems through phishing emails laden with malware, masquerading as official documents or payment orders from legitimate organizations. Once a computer is infected, the hackers establish remote connections, disable security systems like Windows Defender, and program the device to operate between 1 am and 5 am. During this time, they steal login credentials and gather information about the device's RAM, CPU cores, and GPUs to configure the crypto miner optimally.
The campaign, which began in December 2024, has affected numerous Russian users, particularly in industrial enterprises and engineering schools, with additional victims in Belarus and Kazakhstan. The origin of the group remains unclear, but Kaspersky notes that the phishing emails are composed in Russian and include archives with Russian filenames, suggesting that the primary targets are likely based in Russia or speak Russian. The hackers maintain a connection to the mining pool, sending requests every 60 seconds, and continuously refine their tactics, which include data exfiltration, deployment of remote access tools, and use of phishing sites for email account compromise.
Kaspersky speculates that the Librarian Ghouls might be hacktivists, using hacking as a form of civil disobedience to promote a political agenda. This speculation is based on their reliance on legitimate third-party utilities rather than developing their own malicious binaries. The duration of the group's activity is uncertain, but another Russian cybersecurity firm, BI. ZONE, reported on November 23 that Rare Werewolf has been active since at least 2019. The ongoing cryptojacking campaign highlights the evolving tactics of cybercriminals and the importance of robust cybersecurity measures to protect against such threats.