Hacker group Libra Ghouls attacks Russian devices for cryptocurrency mining According to Cointelegraph, Kaspersky has revealed that the hacker group "Libra Ghouls" (also known as Rare Werewolf) is launching cryptocurrency hijacking attacks against Russia. The organization has spread malicious software through phishing emails disguised as official documents, infecting hundreds of devices, with the main victims including industrial enterprises and engineering schools. The attack process shows that the hacker remotely controlled the device from 1-5 am, stole login credentials, and evaluated the hardware configuration before deploying the cryptocurrency mining program. Kaspersky pointed out that the organization prefers to use legitimate third-party tools rather than self-developed malware, which is a technical feature similar to the hacker activist group.