Outpost24 Research on Multi-Stage EncryptHub Malware Campaign
Outpost24’s KrakenLabs has released research on a new EncryptHub multi-stage malware campaign.
While previous reports have begun to shed light on the operation of this rising criminal entity, Outpost24’s KrakenLabs investigation has gone a step further, uncovering previously unseen aspects of their infrastructure, tooling, and behavioral patterns.
Through a series of operational security (OPSEC) missteps, EncryptHub inadvertently exposed critical elements of its ecosystem, allowing Outpost24 to map their tactics with unprecedented depth.
Their lapses include directory listing enabled on key infrastructure components, hosting stealer logs alongside malware executables and PowerShell scripts, and revealing Telegram bot configurations used for data exfiltration and campaign tracking.
These mistakes provided a unique vantage point into their operations, enabling Outpost24’s researchers to dissect their attack chain and methodologies in ways that have not yet been publicly detailed.
You can read the research here.
April 3, 2025 at 11:36 am
[…] who has been gaining popularity in recent months and is heavily expanding and evolving operations. Part 1 covered EncryptHub’s campaigns and TPPs, infrastructure, infection methods, and […]