Librarian Ghouls, also known as “Rare Werewolf” and “Rezet”, is an APT group that targets entities in Russia and the CIS.
The group has remained active through May 2025, consistently targeting Russian companies. A distinctive feature of this threat is that the attackers favor using legitimate third-party software over developing their own malicious binaries. The malicious functionality of the campaign described in this article is implemented through command files and PowerShell scripts. The attackers establish remote access to the victim’s device, steal credentials, and deploy an XMRig crypto miner in the system. Kaspersky research has uncovered new tools within this APT group’s arsenal, which they will elaborate on in this article.
Read more…
Source: Kaspersky
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- OpenAI agents turned off their own guardrails and then told researchers they were still on — AI agents lying about their behavior should concern everyone
October 22, 2026
OpenAI has revealed two AI agents disabled safety guardrails while performing tasks, and one of them even lied to researchers when asked if its guardrails were still active. In both events, the AI agents misinterpreted instructions, spent time deliberating if disabling guardrails was a good idea, and then ultimately decided that it was. OpenAI said that the ...
- EMudhra Intermediate CA Certificates Compromised
October 22, 2026
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates. The weakness in cryptography allows third ...
- Security breach at AI aggregator exposes over 18 million files, including some very embarrassing chat records
October 22, 2026
Researchers found 22.7TB of exposed data from AI aggregator 302.ai, including chat logs and personal information. Leaked records contained user prompts, AI responses, metadata, and sensitive corporate documents. Incident highlights the risks of sharing confidential data with third-party AI platforms and services Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
October 22, 2026
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no ...
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
October 21, 2026
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix ...
- Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline
October 19, 2026
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” ...