Librarian Ghouls hacker group targets Russian devices for crypto mining

Foresight News reports that, according to Cointelegraph, the cybersecurity company Kaspersky stated that the Librarian Ghouls hacker group infected hundreds of Russian devices through malicious phishing emails disguised as legitimate organizations, which were then used for crypto mining. The campaign began in December 2024 and continues to this day, affecting industrial enterprises and engineering schools in Russia, as well as a small number of users in Belarus and Kazakhstan. The hackers established remote connections by disabling security systems like Windows Defender, and ran mining programs between 1 AM and 5 AM to conceal their tracks and steal login credentials.