What ultimately led to EncryptHub’s unmasking was a catastrophic series of operational security failures, including password reuse across criminal infrastructure, failure to enable two-factor authentication, and inadequate server hardening that left directory listings publicly accessible. A notorious threat actor operating under the alias “EncryptHub” has been exposed due to a series of operational security failures and unconventional use of AI tools. What distinguishes EncryptHub from typical cybercriminals is the dichotomy of his activities – while conducting malicious campaigns, he simultaneously contributed to legitimate security research, even receiving acknowledgment from Microsoft Security Response Center for discovering CVE-2025-24071 and CVE-2025-24061. This Ukrainian cybercriminal, who fled his hometown approximately a decade ago, has been orchestrating increasingly sophisticated ransomware campaigns since early 2024, targeting organizations worldwide with custom-built malware designed to steal cryptocurrency and sensitive information. This case highlights the emerging trend of threat actors leveraging artificial intelligence for malware development while still falling victim to basic security mistakes. The AI assistant was leveraged to create nearly every component of his malicious infrastructure, from writing malware code to configuring Telegram bots, command and control servers, phishing sites, and onion services. EncryptHub’s exposed infrastructure revealed numerous IOCs, including multiple PowerShell scripts, executable files, and command and control domains like vexio[.]io and echonex[.]ai that organizations should monitor for in their environments. Outpost24’s KrakenLabs researchers identified the malware after discovering an exposed JSON configuration file on EncryptHub’s command and control server. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Perhaps most critically, the threat actor tested his own malware on development systems, inadvertently exfiltrating his personal information and access credentials. A sophisticated phishing campaign dubbed "PoisonSeed" has emerged targeting customer relationship management (CRM) and bulk email service providers in a concerning supply chain attack. In one particularly revealing conversation, EncryptHub asked the AI to evaluate whether he was better suited to be a “black hat or white hat” hacker, even confessing to criminal activities and exploits he had developed. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. This file contained Telegram bot information that provided investigators with a digital trail leading directly to the threat actor’s activities. The clipper malware developed with ChatGPT’s assistance represents one of EncryptHub’s primary attack vectors.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 04 Apr 2025 14:55:14 +0000