Researchers from KrakenLabs have exposed the operations chain of malware threat actor EncryptHub after the latter suffered security lapses. EncryptHub had compromised over 600 entities, using a multi-stage process involving trojanized applications and sophisticated scripts to extract sensitive victim data. KrakenLabs also found that EncryptHub uses a third-party “pay-per-install” broker to spread its malware and is developing a control interface, called EncryptRAT, to manage attacks more efficiently.
North Korean Hackers Use Fake U.S. Companies to Spread Malware in Crypto Industry: Report
North Korean hackers reportedly set up shell companies in the US to penetrate the crypto sector and target developers via fake job offers, according to
