Analysts reported a new wave of hidden mining in Russia.

The hacker group Librarian Ghouls, also known as Rare Werewolf, has hacked hundreds of Russian devices for covert cryptocurrency mining. This was reported by specialists from Kaspersky Lab.

Infection Algorithm

Malicious actors gained access to the systems through phishing emails. They are disguised as messages from real organizations and appear as official documents or payment orders.

After infecting the computer with malware, hackers establish a remote connection and disable protective systems, including Windows Defender. They disable security systems, such as Windows Defender. Then they configure the device to automatically turn on at 1 AM and turn off at 5 AM. According to Kaspersky Lab, this is how attackers conceal their actions from the user.

During this time, they also steal credentials. Before launching the miner, the attackers gather information about the system: the amount of RAM, the number of CPU cores, and data about the graphics card. This allows them to optimally configure the program for cryptocurrency mining. While the miner is running, hackers maintain communication with the pool, sending requests every minute.

When the attacks began

The campaign began in December 2024 and continues to this day. Hundreds of Russian users have been affected, mainly industrial enterprises and technical universities. Isolated cases have been recorded in Belarus and Kazakhstan.

The origin of the group is unknown. Analysts noted that the phishing emails are written in Russian, contain archives with Russian titles, and bait documents. This suggests that the campaign is likely targeting Russian-speaking users or residents of Russia.

Experts suggest that Librarian Ghouls may be so-called hacker activists. The group uses legal third-party software instead of developing its own malicious code — a characteristic feature of such organizations. According to another company, BI.ZONE, the Rare Werewolf group has been active for at least since 2019.

Recall that in December 2024, analysts from “Kaspersky Lab” reported on a new scam on YouTube.

In May, the damage to the crypto industry from hacks reached $244 million