{"id":13578,"date":"2025-04-05T16:45:28","date_gmt":"2025-04-05T16:45:28","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/hacker-behind-618-breaches-exposes-windows-flaws\/"},"modified":"2025-04-05T16:45:29","modified_gmt":"2025-04-05T16:45:29","slug":"hacker-behind-618-breaches-exposes-windows-flaws","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/hacker-behind-618-breaches-exposes-windows-flaws\/","title":{"rendered":"Hacker Behind 618+ Breaches Exposes Windows Flaws"},"content":{"rendered":"\n<\/p>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiAMAnz-LMCwpKGmZD-x3MQ_sDKw7Zz3eEyNAHZnqsbm7_p1cjlkW89E44ABBQ6GCRQ-Lq7D9WUlimx5hA4OHCivazKWdEcLRpEa3-FISA-8e2jvM4vCWEGmXyjC4pZVGGdZy574s-K4t6Y47hPYQ2eDSh-DNYztFxg329ov9HCfXNNDmO-1j_vu9Pk4uOT\/s728-rw-e365\/ms-hacker.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p><\/a>\n<\/div>\n<p>A lone wolf actor, known as <strong>EncryptHub<\/strong>, has been acknowledged by Microsoft for discovering and reporting two security flaws in Windows last month. This acknowledgement has shed light on a &#8220;conflicted&#8221; individual who is balancing a legitimate career in cybersecurity with a life of cybercrime.<\/p>\n<p>In a recent <a href=\"https:\/\/outpost24.com\/blog\/unmasking-encrypthub-chatgpt-partner-crime\/\" rel=\"noopener nofollow\" target=\"_blank\">analysis<\/a> published by Outpost24 KrakenLabs, the Swedish security company has unmasked the up-and-coming cybercriminal. According to the report, the individual fled their hometown in Kharkov, Ukraine, around 10 years ago and moved to a new location near the Romanian coast.<\/p>\n<p>The vulnerabilities were credited by Microsoft to a party named &#8220;SkorikARI with SkorikARI,&#8221; which has been assessed to be another username used by EncryptHub. The two security flaws, both of which were fixed by Redmond as part of its <a href=\"https:\/\/thehackernews.com\/2025\/03\/urgent-microsoft-patches-57-security.html\" target=\"_blank\" rel=\"nofollow noopener\">Patch Tuesday update<\/a> last month, are as follows:<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-24061\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2025-24061<\/a><\/strong> (CVSS score: 7.8) &#8211; Microsoft Windows Mark-of-the-Web (MotW) Security Feature Bypass Vulnerability<\/li>\n<li><strong><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-24071\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2025-24071<\/a><\/strong> (CVSS score: 6.5) &#8211; Microsoft Windows File Explorer Spoofing Vulnerability<\/li>\n<\/ul>\n<p>EncryptHub, also tracked under the monikers LARVA-208 and Water Gamayun, was <a href=\"https:\/\/thehackernews.com\/2025\/03\/encrypthub-deploys-ransomware-and.html\" rel=\"noopener nofollow\" target=\"_blank\">highlighted<\/a> in mid-2024 for their involvement in a campaign that leveraged a fake WinRAR site to distribute various kinds of malware hosted on a GitHub repository named &#8220;encrypthub.&#8221;<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/drata-2\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhN1uI1E5YtmizCbJK1rBIcH3D-aBh13zB90mpcC4bm3RL8RdDD0MbFOqXzdS5KfLKTkV7oPj_Pq2ii4n4G1D8PuvYHaFvdkln7ULET-ragiWUqoSrWsNzpUSL90a96kEadq0_AvOaG0E7HyWy9I_nCZPNg2KSm3y_v4I3u7dqBMmp4rPk1cQG3ygi_6wlG\/s728-e300\/drata-2-d.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>In recent weeks, the threat actor has been <a href=\"https:\/\/thehackernews.com\/2025\/03\/encrypthub-exploits-windows-zero-day-to.html\" rel=\"noopener nofollow\" target=\"_blank\">linked<\/a> to the <a href=\"https:\/\/thehackernews.com\/2025\/03\/russian-hackers-exploit-cve-2025-26633.html\" rel=\"noopener nofollow\" target=\"_blank\">zero-day exploitation<\/a> of another security flaw in Microsoft Management Console (CVE-2025-26633, CVSS score: 7.0, aka MSC EvilTwin) to deliver information stealers and previously undocumented backdoors named SilentPrism and DarkWisp.<\/p>\n<p>According to PRODAFT, EncryptHub is estimated to have compromised over 618 high-value targets across multiple industries in the last nine months of its operation.<\/p>\n<p>Lidia Lopez, Senior Threat Intelligence Analyst at Outpost24, stated, &#8220;All data analyzed throughout our investigation points to the actions of a single individual.&#8221; However, she also noted, &#8220;We cannot rule out the possibility of collaboration with other threat actors. In one of the Telegram channels used to monitor infection statistics, there was another Telegram user with administrative privileges, suggesting potential cooperation or assistance from others without a clear group affiliation.&#8221;<\/p>\n<p>Outpost24 was able to piece together EncryptHub&#8217;s online footprint from the &#8220;actor&#8217;s self-infections due to poor operational security practices,&#8221; uncovering new aspects of their infrastructure and tooling in the process.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj4QuhV6MrHDXacYX_3m_HDViO0UZhBqMlUf6nfa8xzAp9oGeWOdU1unxgWjeLPfOS92We4UiTeSGhNa5fGr61ocieJ03U8n6fEcGF1E0NE6mCPU2nXlcdAtpHWBJtC70jIefGJB3ig11xIYFf1RFZGv1KA27RZtbqoSHQ8jV9mIylrgYx0BlTYW7QlEfBU\/s728-rw-e365\/loaders.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj4QuhV6MrHDXacYX_3m_HDViO0UZhBqMlUf6nfa8xzAp9oGeWOdU1unxgWjeLPfOS92We4UiTeSGhNa5fGr61ocieJ03U8n6fEcGF1E0NE6mCPU2nXlcdAtpHWBJtC70jIefGJB3ig11xIYFf1RFZGv1KA27RZtbqoSHQ8jV9mIylrgYx0BlTYW7QlEfBU\/s728-rw-e365\/loaders.jpg\" alt=\"\" border=\"0\" data-original-height=\"601\" data-original-width=\"728\"\/><\/a><\/div>\n<p>The individual is believed to have kept a low profile after moving to an unspecified location near Romania, where they studied computer science through online courses and sought computer-related jobs.<\/p>\n<p>All of the threat actor&#8217;s activity, however, abruptly ceased in early 2022, coinciding with the <a href=\"https:\/\/thehackernews.com\/2022\/02\/new-wiper-malware-targeting-ukraine.html\" rel=\"noopener nofollow\" target=\"_blank\">onset of the Russo-Ukrainian war<\/a>. Outpost24 found evidence suggesting that the individual was jailed around the same time.<\/p>\n<p>&#8220;Once released, he resumed his job search, this time offering freelance web and app development services, which gained some traction,&#8221; the company said in the report. &#8220;But the pay likely wasn&#8217;t enough, and after briefly trying bug bounty programs with little success, we believe he pivoted to cybercrime in the first half of 2024.&#8221;<\/p>\n<p>One of EncryptHub&#8217;s earliest ventures in the cybercrime landscape is <a href=\"https:\/\/thehackernews.com\/2024\/06\/new-rust-based-fickle-malware-uses.html\" rel=\"noopener nofollow\" target=\"_blank\">Fickle Stealer<\/a>, which was first documented by Fortinet FortiGuard Labs in June 2024 as a Rust-based information stealer malware distributed via multiple channels.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zscaler-inside-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjRFO5s2w2a-LYExVqmIzfz6CnCaWYIL8AQm2htTkuz9tueMoNcuhrPw0p-_fT9T5bOK9BonkBRKORSMcMUDyBSxRV1iT6whGPaUFHaJ6AiMmFzK5SQbYPumrOaibXKLYAo2i6Y237CYFzMKtqeMFzUFbVEb4ZRBRNQDz52duWN4i2gyE0YwRJipkSYSEbB\/s728-e100\/zz-d.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>In a <a href=\"https:\/\/g0njxa.medium.com\/approaching-stealers-devs-a-brief-interview-with-encrypthub-fickle-stealer-518bde3b174f\" rel=\"noopener nofollow\" target=\"_blank\">recent interview<\/a> with security researcher g0njxa, the threat actor claimed that Fickle &#8220;delivers results on systems where StealC or Rhadamantys (sic) would never work&#8221; and that it &#8220;passes high-quality corporate antivirus systems.&#8221; They also stated that the stealer is not only being shared privately but is also &#8220;integral&#8221; to another product dubbed EncryptRAT.<\/p>\n<p>&#8220;We were able to associate Fickle Stealer with an alias previously tied to EncryptHub,&#8221; Lopez said. &#8220;Additionally, one of the domains linked to that campaign matches infrastructure connected to his legitimate freelance work. From our analysis, we estimate EncryptHub&#8217;s cybercriminal activity began around March 2024. Fortinet&#8217;s reporting in June likely marks the first public documentation of these actions.&#8221;<\/p>\n<p>EncryptHub is also said to have relied extensively on OpenAI&#8217;s ChatGPT to assist with malware development, even using it to aid in translating emails and messages and as a confessional tool.<\/p>\n<p>&#8220;EncryptHub&#8217;s case highlights how poor operational security remains one of the most critical weaknesses for cybercriminals,&#8221; Lopez pointed out. &#8220;Despite technical sophistication, basic mistakes \u2013 like password reuse, exposed infrastructure, and mixing personal with criminal activity \u2013 ultimately led to his exposure.&#8221;<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/04\/microsoft-credits-encrypthub-hacker.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A lone wolf actor, known as EncryptHub, has been acknowledged by Microsoft for discovering and reporting two security flaws in Windows last month. This acknowledgement has shed light on a&#8230;<\/p>\n","protected":false},"author":19,"featured_media":13579,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-13578","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/04\/ms-hacker.jpg","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/13578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=13578"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/13578\/revisions"}],"predecessor-version":[{"id":13580,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/13578\/revisions\/13580"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/13579"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=13578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=13578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=13578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}