EncryptHub’s Strategic Blunders Expose Cyber Schemes and Future Ambitions

Summary

• EncryptHub, a prolific cybercriminal, made operational security (OpSec) mistakes that exposed much of the operation.
• The mistakes also revealed plans for new tools.
• Researchers have now mapped the group’s tactics, techniques and procedures (TTPs).
• The case shows how much defenders can learn from attackers’ errors.

EncryptHub’s mistakes

EncryptHub has been tied to attacks on hundreds of organizations, but researchers at Outpost24 found its infrastructure full of OpSec failures. A directory listing on one of its web domains exposed logs of stolen data, malware, PowerShell scripts and Telegram bot configuration files used to exfiltrate data and track campaigns. Researchers who track the actor believe it is a single person.

“Inside there, we found a directory listing with a lot of the logs of what he’s been stealing, and other binaries he’s been distributing,” Borja Rodriguez, manager of threat intelligence operations at Outpost24, told Dark Reading.

Tactics, Techniques, and Procedures (TTPs)

An earlier report from PRODAFT, which tracks the actor as LARVA-208, described targeted social engineering: calls posing as IT support, text messages with links to fake VPN login pages, and pressure to install remote management tools such as AnyDesk. Outpost24 also found trojanized versions of popular apps such as WeChat and Google Meet that installed infostealers, along with a pay-per-install service for mass distribution. Files were sometimes encrypted with RansomHub, BlackSuit or a homemade PowerShell locker.

Knowing these methods helps defenders block them. Most rely on tricking people, not on advanced exploits.

What comes next for EncryptHub

Researchers suspect EncryptHub may work as an initial access broker, selling access to ransomware groups. Outpost24 found a new remote access tool, EncryptRAT, that can manage infections from several stealers at once, and expects it may be offered for sale.

The researchers also saw EncryptHub using ChatGPT to build tools and to learn how to exploit vulnerabilities in Palo Alto and Fortinet devices, which they see as a sign the actor is not very technical.

What defenders should do

Train staff to verify unexpected IT support calls and texts, require phishing-resistant multi-factor authentication, restrict which remote management tools can run, and download software only from official sources.

Those steps would have stopped most of what EncryptHub did.

Learning from the attacker

EncryptHub’s mistakes gave researchers an unusually complete view of a working criminal operation.

Watch whether EncryptRAT shows up for sale and whether other researchers link more attacks to the same infrastructure. Attackers make mistakes too.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.