LARVA-208 (EncryptHub) is a threat actor that has come to the forefront with highly sophisticated spear-phishing attacks since 26 June 2024. In the attacks it has carried out, it exhibits a different operational strategy by carrying out all the processes necessary to obtain initial access through personalized SMS (smishing) or by calling the person directly (vishing) and tricking the victim into installing remote management software. When investigating the attacks carried out by the threat actor, it is evident that their social engineering techniques and persuasion skills are highly effective.
In the first phase, the actor usually creates a phishing site that targets the organization to obtain the victim's VPN credentials. The victim is then called and asked to enter the victim's details into the phishing site for technical issues, posing as an IT team or helpdesk. If the attack targeting the victim is not a call but a direct SMS text message, a fake Microsoft Teams link is used to convince the victim. After gaining access from the victim user, the team runs various stealers on the compromised machine using the PowerShell scripts they have developed. The team currently prefers Fickle Stealer, StealC, and Rhadamanthys among these stealer scripts, which are run to collect sensitive information on the victim's machine. In most attacks conducted by LARVA-208, ransomware was utilized in the final stage to encrypt the victim's device and demand a ransom.
Discovery Report can be found at Catalyst Platform.
global-protect.us
encrypthub.org
encrypthub.us
concur.net.co
lankantour.com
blackangel.dev
fuckedserver.net
wwwciscoweb.com
webvpnpaloalto.com
webpaloaltovpn.com
webpaloalto.com
webmicroteam.com
weblogonlink.com
weblinkteams.com
web-cisco.com
vpnwebpaloalto.com
vpnpaloalto.com
vpnpalaolto.com
vpnglobale.com
vpnciscoweb.com
vpncisco.com
team-accept.com
speedworkingonline.com
quick-assist.link
protectlogon.com
pointlogin.com
panel-cisco.com
palaoltowebvpn.com
nbvzcvuyqiehjfadbh13adf.com
nampakdata.org
msquick.link
microteams.link
logonprotect.com
logonpointportal.com
logonlink.com
linkwebcisco.com
letmevpn.com
iujhqdfzoijknqehhtpsdn.com
ioqerhbabvfdqiehhqehgrnadmfn.com
iciscoweb.com
hycisco.com
hiecisco.com
heicisco.com
hecisco.com
fortivpnlink.com
fadmaitadhjuqjnad.com
dkjjfhaajiuyqoenzvbxcmqlp.com
ciscoweblink.com
ciscowebdomain.com
ciscolinkweb.com
ciscolinkacc.com
ciscoacclink.com
boostservermanage.com
blackdjackdomain.com
awildy.com
autvpn.link
authvpn.link
audsfhiquyetfgdbas.com
adfquehdbvfquedhfqehg.com
adfajhyqienfagdfjaldki.com
accept-team.com
a87df13naf8ah3j1qnafd.com
13984fgklknn294jkg.com
82.115.223.182
185.232.205.188
147.45.114.96
195.133.17.185
185.121.134.153
81.29.149.240
150.241.123.250
87.120.186.106
93.123.84.87
212.192.13.136
185.219.7.204
185.219.7.201
147.45.125.120
103.136.150.88
94.159.100.245
87.251.79.178
142.93.105.148
144.76.81.222
165.22.95.37
167.172.183.49
185.185.51.194
190.2.147.35
193.37.69.163
193.37.69.197
193.37.69.50
193.37.69.65
193.37.69.67
193.37.69.88
195.123.222.45
195.123.240.254
212.8.252.126
45.11.59.76
45.131.215.16
64.190.113.104
64.95.11.119
64.95.12.93
72.5.43.74
79.141.173.88
80.66.66.40
87.251.67.185
89.23.107.234
94.232.249.246
sohaflats.com
acceptquick.link
sunakhee.com
appquick.link
t.me/encrypthub
| SHA256 |
|---|
| 6ff41a14b6ae1e91b64e50e1a3df5478ff35172f45ae45720199bd353645b0a9 |
| 5d309b0ab05b1eddfd9bac88c0d0baa4172f76565c31acf82d59da885c3f6c38 |
| 411e6413afc5dadc63f69dd37d25f23dfee1fbd5eff1a591ba33dfc38ca5a4fd |
| 98c61ae4fcd6f04d45d089733aed0e2f39b18d707d17f535cb07891f8f1b9f62 |
| f68d257d8c1a89c7c358383d0cb58aea5aa594bc441f0963cf1881bf4ef46640 |
| 6ff8a78af617715aa950688eac1bf5e0a8cb198bb9edc144ae1b9c87445b2333 |
| 2c5210fbdb4d98adf4b28f001cee628ce1d4230cd3f89d7666c0ca5a03fd0cef |
| 3078f35603d15466836ee820bb32ad6c806af1148c73fa251273f00c7528af76 |
| 47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593 |
| 019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a |
| 6c4f0d6ac77c303e66164da47647b5477a517b7df4cafee71a4753df07300603 |
| 4192844c08997d6e198c0511821d0b6cdf8c87aa94cb0b2cd249c114e2c75bb6 |
| 57ba0a5be8b2dfa2a7da564f1c50fd277212743e33e392af924da6eeb997e5db |