Skip to content

Latest commit

 

History

History
163 lines (151 loc) · 4.67 KB

File metadata and controls

163 lines (151 loc) · 4.67 KB

LARVA-208 Group Indicators of Compromise (IOC)

LARVA-208 (EncryptHub) is a threat actor that has come to the forefront with highly sophisticated spear-phishing attacks since 26 June 2024. In the attacks it has carried out, it exhibits a different operational strategy by carrying out all the processes necessary to obtain initial access through personalized SMS (smishing) or by calling the person directly (vishing) and tricking the victim into installing remote management software. When investigating the attacks carried out by the threat actor, it is evident that their social engineering techniques and persuasion skills are highly effective.

In the first phase, the actor usually creates a phishing site that targets the organization to obtain the victim's VPN credentials. The victim is then called and asked to enter the victim's details into the phishing site for technical issues, posing as an IT team or helpdesk. If the attack targeting the victim is not a call but a direct SMS text message, a fake Microsoft Teams link is used to convince the victim. After gaining access from the victim user, the team runs various stealers on the compromised machine using the PowerShell scripts they have developed. The team currently prefers Fickle Stealer, StealC, and Rhadamanthys among these stealer scripts, which are run to collect sensitive information on the victim's machine. In most attacks conducted by LARVA-208, ransomware was utilized in the final stage to encrypt the victim's device and demand a ransom.

Discovery Report can be found at Catalyst Platform.

Operational Environment

Command and Control Server Domains

global-protect.us
encrypthub.org
encrypthub.us
concur.net.co
lankantour.com
blackangel.dev
fuckedserver.net

Phishing Domains

wwwciscoweb.com
webvpnpaloalto.com
webpaloaltovpn.com
webpaloalto.com
webmicroteam.com
weblogonlink.com
weblinkteams.com
web-cisco.com
vpnwebpaloalto.com
vpnpaloalto.com
vpnpalaolto.com
vpnglobale.com
vpnciscoweb.com
vpncisco.com
team-accept.com
speedworkingonline.com
quick-assist.link
protectlogon.com
pointlogin.com
panel-cisco.com
palaoltowebvpn.com
nbvzcvuyqiehjfadbh13adf.com
nampakdata.org
msquick.link
microteams.link
logonprotect.com
logonpointportal.com
logonlink.com
linkwebcisco.com
letmevpn.com
iujhqdfzoijknqehhtpsdn.com
ioqerhbabvfdqiehhqehgrnadmfn.com
iciscoweb.com
hycisco.com
hiecisco.com
heicisco.com
hecisco.com
fortivpnlink.com
fadmaitadhjuqjnad.com
dkjjfhaajiuyqoenzvbxcmqlp.com
ciscoweblink.com
ciscowebdomain.com
ciscolinkweb.com
ciscolinkacc.com
ciscoacclink.com
boostservermanage.com
blackdjackdomain.com
awildy.com
autvpn.link
authvpn.link
audsfhiquyetfgdbas.com
adfquehdbvfquedhfqehg.com
adfajhyqienfagdfjaldki.com
accept-team.com
a87df13naf8ah3j1qnafd.com
13984fgklknn294jkg.com

Backend Servers

82.115.223.182
185.232.205.188
147.45.114.96
195.133.17.185
185.121.134.153
81.29.149.240
150.241.123.250
87.120.186.106
93.123.84.87
212.192.13.136
185.219.7.204
185.219.7.201
147.45.125.120
103.136.150.88
94.159.100.245
87.251.79.178

Fast-Flux Frontend Servers

142.93.105.148
144.76.81.222
165.22.95.37
167.172.183.49
185.185.51.194
190.2.147.35
193.37.69.163
193.37.69.197
193.37.69.50
193.37.69.65
193.37.69.67
193.37.69.88
195.123.222.45
195.123.240.254
212.8.252.126
45.11.59.76
45.131.215.16
64.190.113.104
64.95.11.119
64.95.12.93
72.5.43.74
79.141.173.88
80.66.66.40
87.251.67.185
89.23.107.234
94.232.249.246

Deceptive URL Redirection Domain

sohaflats.com
acceptquick.link
sunakhee.com
appquick.link

Telegram Contact Channel

t.me/encrypthub

Hashes

SHA256
6ff41a14b6ae1e91b64e50e1a3df5478ff35172f45ae45720199bd353645b0a9
5d309b0ab05b1eddfd9bac88c0d0baa4172f76565c31acf82d59da885c3f6c38
411e6413afc5dadc63f69dd37d25f23dfee1fbd5eff1a591ba33dfc38ca5a4fd
98c61ae4fcd6f04d45d089733aed0e2f39b18d707d17f535cb07891f8f1b9f62
f68d257d8c1a89c7c358383d0cb58aea5aa594bc441f0963cf1881bf4ef46640
6ff8a78af617715aa950688eac1bf5e0a8cb198bb9edc144ae1b9c87445b2333
2c5210fbdb4d98adf4b28f001cee628ce1d4230cd3f89d7666c0ca5a03fd0cef
3078f35603d15466836ee820bb32ad6c806af1148c73fa251273f00c7528af76
47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593
019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a
6c4f0d6ac77c303e66164da47647b5477a517b7df4cafee71a4753df07300603
4192844c08997d6e198c0511821d0b6cdf8c87aa94cb0b2cd249c114e2c75bb6
57ba0a5be8b2dfa2a7da564f1c50fd277212743e33e392af924da6eeb997e5db